posted 08-20-2003 06:09 PM
a sobig deal...
The "Sobig.F" computer virus that began attacking e-mail systems globally Tuesday has been declared the fastest-spreading e-mail virus of all time.
Meanwhile, the Blaster and Nachi Internet worms continued to bombard corporate networks, having even caused slowdowns on parts of the Internet backbone.
"People throw up their hands," said Andy Ellis, chief security architect at Akamai Technologies Inc. (NasdaqSC:AKAM - News) . "There's only so many things people can focus on at one time."
MessageLabs Inc., a company that filters e-mail for corporate clients around the world, said it intercepted more than one million copies of Sobig.F Tuesday, the most ever in a single day.
The interception rate was one in every 17 e-mail messages the firm scanned. " That's just a number we've never seen before," said Brian Czarny, MessageLabs' marketing director. The most widespread virus of all time, Klez, at its peak accounted for one in 125 messages scanned.
Sobig.F continued to spread aggressively Wednesday, though the pace eased off a bit to about one in 60 messages, added Mr. Czarny.
Sobig.F, which is the sixth and latest strain of a virus that first emerged in January, spreads through Windows personal computers via e-mail and network file- share systems. Besides clogging e-mail systems full of messages with subjects like "Re: Details" and "Re: Wicked screensaver," the virus also deposits a Trojan horse, or hacker back door, that can be used to turn victims' PCs into spam machines.
"It's a seeding," said Mr. Czarny. "All they're looking to do is plant that Trojan."
Sobig.F can overwhelm e-mail servers, and deleting all those messages can consume users' time, said Mr. Ellis. "I think Nachi's really going to be the one that hurts us from the volume perspective -- us being the Internet."
The Nachi worm, which first appeared last week, spreads through Internet connections to PCs using versions of Microsoft Corp.'s Windows operating system that hadn't been fixed for a programming flaw. Microsoft disclosed the error and provided a patch to fix it a month ago.
Nachi appears to have been created to fight off Blaster, which also exploited the flaw, because it tries to remove Blaster from PCs and download Microsoft's patch.
In response to the Blaster outbreak, which caused disruptions for hundreds of thousands of computers last week, Microsoft launched a "Protect Your PC" campaign Tuesday. The company bought ads in several newspapers and set up a Web site, www.microsoft.com/protect, to educate customers about setting up firewalls, regularly downloading software-security fixes and using antivirus software.
Nachi may not be more widespread than Blaster, but it has a technically superior scanner for finding vulnerable machines to infect. As such, it is now generating more Internet traffic than Blaster -- twice as much, said Mr. Ellis.
The worm hasn't, as of yet, caused any widespread failures that have affected the Internet as a whole, he added. But a lot of companies have been reporting problems inside their networks and there have been "a couple of points where parts of the backbone had performance issues" in the last 24 hours, said Mr. Ellis, especially Tuesday afternoon, when Nachi's scanning rate jumped, a sign of a rising infection rate.
"Nachi is a long-term problem that has to be dealt with," he went on to say. " These systems absolutely have to be patched."
http://news.yahoo.com/news?tmpl=story2&cid=808&u=/dowjones/20030820/bs_dowjones/200308201654001134&printer=1