SoBig.F Piles On the Worm Effect

At the tail end of what could be called this summer's "Worm Week," antivirus and security experts watched carefully as the spreading SoBig.F variant flooded in-boxes around the Internet with millions of virus-laden e-mails.

Antivirus researchers said the worm, which was set to activate a barrage of e-mail from infected machines Friday, was not especially alarming but did take advantage of previous worms Blaster and Nachi and generated massive amounts of e-mail during its rampage.

"In terms of infected computers, I wouldn't say it's the worst ever," McAfee Avert virus research engineer Craig Schmuger told TechNewsWorld. "In terms of generating e-mail traffic, it is the worst."

Mystery Code Countdown

As home and corporate users were deluged with e-mail caused by SoBig.F, security experts watched closely for effects of a secondary attack programmed into the worm.

Infected Windows computers were instructed to download an unknown piece of software from a list of 20 Internet addresses every Friday and Sunday afternoon.

After the programmed activation began on Friday, MessageLabs chief technology officer Mark Sunner told TechNewsWorld that the 20 targeted machines had been taken offline and that there were no indications that SoBig.F's coded instructions were having additional impact.

You've Got Worm

Schmuger, who said McAfee partner AOL had reported 11.5 million infected e-mail messages, indicated that even though SoBig.F requires users to open e-mail and click on an attachment, the worm was having widespread impact.

The worm spoofs the sender field of the e-mail, making it appear to have come from an acquaintance. Once unleashed, the worm harvests e-mail addresses from infected computers to continue propagating.

Symantec (Nasdaq: SYMC) Security Response group product manager Kevin Haley told TechNewsWorld that although most corporate IT systems block the executable attachments included in SoBig.F, the undeliverable reports bouncing back to hijacked sender addresses were adding to the e-mail onslaught.

Bad for Business

Haley said the vast majority of SoBig.F submissions to Symantec was coming from home users, though some corporations also had been infected.

Schmuger said the worm was challenging small businesses without the IT staff to manage and secure systems. For larger corporations, the difficulty is in dealing with large numbers of computers and users, according to Schmuger, who said e-mail servers were taking on burdensome loads as a result of the outbreak.

Schmuger added that securing corporate systems is made more difficult by remote access and by home workers using their own systems to link to enterprise networks.

Spam Gets Slippery

The worm, which hit millions of users worldwide and, according to some reports, nearly one-third of e-mail users in China, takes advantage of spamming tools and techniques to spread, a technique that antivirus experts called a continuing problem.

"It's a growing trend," Schmuger said. "They compromise systems and open relays they're allowed to let software through."

Schmuger said a spam-like worm such as SoBig.F could be used to spread millions of e-mails via "porn dialers" -- mail applications that send users to pornography sites -- and through trojans -- malicious code meant to cede control of a computer to a remote attacker or program.

Cumulative Effect

While MessageLabs called SoBig.F's spread the fastest in computer virus history, Haley downplayed the variant's impact, citing higher submission rates for the Klez.H and BugBear viruses.

But Schmuger said that by hitting home and corporate machines as users and IT staff were dealing with previous outbreaks of Blaster and Nachi, SoBig.F managed to be more disruptive.

"When you look at the worms individually, they're not that out of the ordinary in the grand scheme of things," he said. "It's really just the compressed time scale that is alarming. We may see more virus writers trying to seize on the opportunity of other worms."