Sobig 'Carpet Bombs' the Internet
Sobig-F, which has been causing chaos on corporate networks the past three days, is now being called the fastest spreading virus in the industry's history.
''It was a carpet bombing,'' says Chris Belthoff, a senior security analyst with Lynfield, Mass.-based Sophos Inc., an anti-virus company. ''We're judging this to be the fastest spreading worm ever, even surpassing Klez and LoveBug. This is really just a complete swamping, or inundation, of networks... Companies are having their email systems taken down because of the sheer volume of emails they're getting. It's a slow down, then a slow to a crawl and then just being taken offline.''
Sobig-F, which first appeared this past Monday as the latest member of the malicious Sobig virus family, hit the Internet hard, flooding email servers and inboxes. Corporate networks staggered under the barrage with network access slowing to a crawl, and some email systems being taken temporarily offline to stop the siege.
AOL saw email traffic nearly quardruple yesterday, according to Nicholas Graham, an AOL spokesman. Graham says AOL scans email attachments at the gateway, checking for viruses. On an average day, the ISP scans approximately 11 million attachments. On Wednesday, the staff scanned 40.5 million email attachments and found 23.7 of those to be infected with viruses. Of those, 23.2 million were infected with Sobig-F.
And Shoer says the virus attack is bringing regular work to a standstill.
''It's rendered IT staffs useless,'' he adds. ''They're just flooded. If there was going to be a rollout or something, it's just not getting done. We're putting off everything that was a high priority.''
Shoer also noted that he talked to an IBM engineer on Wednesday who wasn't able to offer him customer service because his email was down. Security analysts verified IBM's troubles but the company could not be reached for comment and its Web site was unresponsive Wednesday afternoon.
''A lot of corporations and universities had to literally shut down their email networks because of the huge volume of traffic of inbound Sobig emails and bounced email messages,'' says Steve Sundermeier, vice president of products and services at Central Command Inc., an anti-virus company based in Medina, Ohio. ''If you're talking about a large corporation -- a Fortune 100 or a Fortune 200 -- and you take down an email system for an hour, it could cost that corporation a million dollars.''
But three different security experts say the Sobig-F assault seems to have peaked yesterday afternoon, when the malicious email was accounting for at least 70 percent of all email flowing around the world. Today, the number is still high but most estimate that it has dropped down into the 60 percent to 70 percent range.
Sophos' Belthoff says the virus, which is a mass-mailing worm that also can spread via network shares, hit the Net so hard so quickly because of the spam-like spreading technique that the author used.
''They carpet bombed the Internet and played the numbers game,'' says Belthoff. ''There were just millions of copies out there hitting the Internet all at the same time. It's a matter of sending out enough copies so that somebody will click on it. When you send out that many, even a small percentage of a response, is going to make for a successful virus.''
But other security analysts say the virus is hitting the Internet so hard because it is building on the impact of its Sobig predecessors.
Sundermeier explains that earlier variants of Sobig have infected computers and then downloaded Trojans to set the machines up to be hidden proxy servers. ''The author has a huge army now for the next seeding,'' he says. ''Every Sobig variant becomes bigger and bigger, and we believe it's because of this army he's building of infected machines.''
Sobig-F is designed to die out on Sep. 10. That's leading many analysts to suspect that the next variant will hit on Sep. 11 or soon after. And if that variant builds on the malicious success of Sobig-F, then the damage could be even worse.
AOL's Graham says they are already planning defenses for the next Sobig attack. ''We're already gearing up for the next variant, Sobig-G, if you will,'' he says.
When the worm arrives via email, it poses as a .pif or .scr file. The sender's address is spoofed. The subject lines used are taken from a list, including 'Re: That movie', 'Re: Wicked screensaver', 'Re: Approved' and 'Your details'.