Feeds

Sobig-F is dead

Good riddance

  • alert
  • submit to reddit

High performance access to file storage

The prolific Sobig-F virus stopped spreading today, marking the end of arguably the worst single email-borne viral epidemic to date.

Managed services firm MessageLabs blocked the virus a staggering 16.5 million times during its month-long spread. At the height of the epidemic, one in 17 emails the firm scanned were viral (other companies say the situation was even worse).

Sobig-F, first detected on 18 August, is the sixth variant issued in the Sobig series and appears to be the most sophisticated to date, according to MessageLabs. Like earlier versions of the virus it was programmed to stop spreading on a set date: for Sobig-F this date was September 10.

Although Sobig-F isn't spreading any more, infected machines still need to be identified and decontaminated.

Sobig-F outstripped the infamous LoveBug, Klez and Kournikova viruses in prevalence but its overall impact is arguably less than that of Internet worm like Slammer and Blaster. In scanning for fresh victims, Blaster generated copious quantities of traffic that had a measurable effect on Internet performance, according to Net performance monitoring firm, which says Sobig-F had a much lesser effect on the Net.

That's small comfort for the numerous users with prominent Net addresses, like us at The Reg, who were carpet bombed by the worm, whose email spoofing tactics created mass confusion.

The effects of the worm raised questions about the effectiveness of traditional AV scanner software. There's concern that it's only a matter of time before a similarly effective email nastie is next released.

Mirror, mirror on the wall: what's the worst virus of them all?

According to a study from security firm TruSecure released earlier this month, the past four years have seen a rise in virus worm infections of 11 per cent per year.

The company broke down this analysis to review on the impact of eight of the biggest viruses over the last four years, giving an indication of the relative severity of each.

Data obtained from the study was obtained from surveys on NT BugTraq, responses from vendors participating in ICSA Labs certification programme, emails passing through TruSecure's Shadowmail messaging service, group monitoring of firewalls and IDS systems and monitoring of the hacker underground by TruSecure.

The figures are accurate within an uncertainty of 20 per cent, according to TruSecure.

Sobig.F - August 2003

The biggest and most virulent worm over the last four years. It infected one in 15 messages during the peak of the outbreak last month. Sobig-F infected 200 million email messages across the Internet during its first week of activity, causing $1 billion in corporate impact through loss of productivity, according to TruSecure. The company estimates Sobig impacted 30 per cent of smaller organisations and 15 per cent of large organisations, chiefly because of the message storm the worm generated. Of these only one in 20 were actually infected.

Blaster - August 2003

One in three (34 per cent) of organisations were infected, 15 per cent of which suffered a moderate or major impact, according to TruSecure. Blaster exploited the DCOM vulnerability - inside infections were very common in large organisations, which led to a significant impact.

Slammer - January 2003

Infected 10 per cent of smaller organisations and 48 per cent of larger companies, according to TruSecure. Slammer exploited a MS SQL Server vulnerability and spread over VPNs, laptops and direct attacks. Perimeter filtering, desktop configuration upgrades and testing eventually succeeded in halting the outbreak.

Klez-H - throughout 2002

Largest infection in 2002. Slow but steady producer of infectious email. TruSecure estimates it infected 12 per cent of corporations via mail, infecting up to 100 million emails in total.

Nimda - September 2001

Nimda, according to TruSecure, infected 68 per cent of corporations, half (48 per cent) of which suffered a major infection. The number of remote users and sites heavily influenced the level of infection. Perimeter filtering, desktop configuration upgrades and testing eventually succeeded in containing the virus.

Code Red - July 2001

According to TruSecure, 38 per cent of corporations suffered a moderate or major infection because of Code Red. The level of infection was highest among businesses with remote users and remote sites.

Love Letter (Love Bug) - May 2000

Infected one in twelve messages and in excess of 100 million total infected messages in the first week. Caused significantly more harm in large organisations than Sobig, infecting nearly 50 per cent of corporations, causing an average of $155,000 of damages to each, and a total cost of $2 billion, according to TruSecure. ®

Related stories

Why Sobig is bad for privacy and AV vendors
AV bigwigs weigh in on Sobig debate
The trouble with anti-virus
Blaster rewrites Windows worm rules
US warns nuke plants of worm threat
Sobig second wave attack fails to strike
Sobig-F is fastest growing virus ever - official
Why spammers lurve the 'Microsoft support' worm (Sobig-A)
Virus writers outpace traditional AV
AV vendors sell 'blunt razor blades'

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.