Feeds

bet365 sends Avril Lavigne worm to punters

Bad tip

  • alert
  • submit to reddit

SANS - Survey on application security programs

Online betting firm bet365 has apologised after sending out a copy of the Avril Lavigne worm to punters on its mailing list last night.

The embarrassing security breach occurred by accident during a process to decommission a Linux box formerly used by the company to run its mailing list.

In normal operation the box prevented external SMTP (mail) connections, according to techies at bet365's Stoke-on-Trent offices. However when this box was rebooted, a mistake in firewall rules meant external mail was let in.

Some external mail turned out to be copies of the Avril Lavigne worm (aka Avril, Naith or Lirva - AV vendors can't agree a name), sent to the mail server by subscribers to the list already infected with the bug. Because of the now, exposed insecure configuration of the mail server these infected emails subsequently propagated on the list.

Avril is pretty much your bog-standard Windows worm. It spreads mainly as an infectious attachment within emails and takes advantage of a year-old exploit in Outlook which permits its execution without a user double clicking on an infected attachment. It can also spread by IRC, ICQ, KaZaA, and open network shares

The worm tries to disable AV and security software and also attempts to email cached Windows dial-up networking passwords to its as-yet unknown creator.

Managed services firm MessageLabs reports capturing 11,165 copies of the virus so far, since first detecting it on Monday (January 6).

bet365 has an active customer base of 10,000 people. Figures for the number of people on the list, much less the numbers who received the Avril worm last night, are unclear. Techies prevented wider spread of the bug by pulling the plug on the insecure mail server before the mailout was completed.

The mail server has being taken completely offline and bet365 is going ahead with its plans to outsource its mailing lists.

"The irony is that it was the process of decommissioning that caused the problem," a systems admin for bet365 told us.

Although some people have complained to bet365 about receiving the virus, the company tells us no one has yet reported becoming infected as a result of its inadvertent viral mail-out.

bet365 apologises for ay inconvenience caused by the incident, which was confined to a problem with its mailing list.

The online bookies runs customer accounts through a completely separate system (running a different OS). These systems were untouched by the mailing list virus problem and bet365's confidential customer account records remain secure, the company assures us. ®

Related Stories

The return of the celebrity virus Avril Lavigne tribute worms up the charts
Kaspersky mailing list hijacked!
BBC in ironic virus infection

External Links

Write up of the Avril Lavigne worm by Symantec and Sophos

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.