Feeds

Sobig-F is dead

Good riddance

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The prolific Sobig-F virus stopped spreading today, marking the end of arguably the worst single email-borne viral epidemic to date.

Managed services firm MessageLabs blocked the virus a staggering 16.5 million times during its month-long spread. At the height of the epidemic, one in 17 emails the firm scanned were viral (other companies say the situation was even worse).

Sobig-F, first detected on 18 August, is the sixth variant issued in the Sobig series and appears to be the most sophisticated to date, according to MessageLabs. Like earlier versions of the virus it was programmed to stop spreading on a set date: for Sobig-F this date was September 10.

Although Sobig-F isn't spreading any more, infected machines still need to be identified and decontaminated.

Sobig-F outstripped the infamous LoveBug, Klez and Kournikova viruses in prevalence but its overall impact is arguably less than that of Internet worm like Slammer and Blaster. In scanning for fresh victims, Blaster generated copious quantities of traffic that had a measurable effect on Internet performance, according to Net performance monitoring firm, which says Sobig-F had a much lesser effect on the Net.

That's small comfort for the numerous users with prominent Net addresses, like us at The Reg, who were carpet bombed by the worm, whose email spoofing tactics created mass confusion.

The effects of the worm raised questions about the effectiveness of traditional AV scanner software. There's concern that it's only a matter of time before a similarly effective email nastie is next released.

Mirror, mirror on the wall: what's the worst virus of them all?

According to a study from security firm TruSecure released earlier this month, the past four years have seen a rise in virus worm infections of 11 per cent per year.

The company broke down this analysis to review on the impact of eight of the biggest viruses over the last four years, giving an indication of the relative severity of each.

Data obtained from the study was obtained from surveys on NT BugTraq, responses from vendors participating in ICSA Labs certification programme, emails passing through TruSecure's Shadowmail messaging service, group monitoring of firewalls and IDS systems and monitoring of the hacker underground by TruSecure.

The figures are accurate within an uncertainty of 20 per cent, according to TruSecure.

Sobig.F - August 2003

The biggest and most virulent worm over the last four years. It infected one in 15 messages during the peak of the outbreak last month. Sobig-F infected 200 million email messages across the Internet during its first week of activity, causing $1 billion in corporate impact through loss of productivity, according to TruSecure. The company estimates Sobig impacted 30 per cent of smaller organisations and 15 per cent of large organisations, chiefly because of the message storm the worm generated. Of these only one in 20 were actually infected.

Blaster - August 2003

One in three (34 per cent) of organisations were infected, 15 per cent of which suffered a moderate or major impact, according to TruSecure. Blaster exploited the DCOM vulnerability - inside infections were very common in large organisations, which led to a significant impact.

Slammer - January 2003

Infected 10 per cent of smaller organisations and 48 per cent of larger companies, according to TruSecure. Slammer exploited a MS SQL Server vulnerability and spread over VPNs, laptops and direct attacks. Perimeter filtering, desktop configuration upgrades and testing eventually succeeded in halting the outbreak.

Klez-H - throughout 2002

Largest infection in 2002. Slow but steady producer of infectious email. TruSecure estimates it infected 12 per cent of corporations via mail, infecting up to 100 million emails in total.

Nimda - September 2001

Nimda, according to TruSecure, infected 68 per cent of corporations, half (48 per cent) of which suffered a major infection. The number of remote users and sites heavily influenced the level of infection. Perimeter filtering, desktop configuration upgrades and testing eventually succeeded in containing the virus.

Code Red - July 2001

According to TruSecure, 38 per cent of corporations suffered a moderate or major infection because of Code Red. The level of infection was highest among businesses with remote users and remote sites.

Love Letter (Love Bug) - May 2000

Infected one in twelve messages and in excess of 100 million total infected messages in the first week. Caused significantly more harm in large organisations than Sobig, infecting nearly 50 per cent of corporations, causing an average of $155,000 of damages to each, and a total cost of $2 billion, according to TruSecure. ®

Related stories

Why Sobig is bad for privacy and AV vendors
AV bigwigs weigh in on Sobig debate
The trouble with anti-virus
Blaster rewrites Windows worm rules
US warns nuke plants of worm threat
Sobig second wave attack fails to strike
Sobig-F is fastest growing virus ever - official
Why spammers lurve the 'Microsoft support' worm (Sobig-A)
Virus writers outpace traditional AV
AV vendors sell 'blunt razor blades'

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.