Feeds

MyDoom dies today

Ding dong the wicked worm is dead

  • alert
  • submit to reddit

SANS - Survey on application security programs

MyDoom-A is programmed to stop spreading today, marking the end of arguably the worst email-borne viral epidemic to date.

MessageLabs, the email filtering firm, blocked the virus 43,979,281 times in the two weeks since its first appearance in late January. At the height of the epidemic, one in 12 emails the firm scanned were viral.

At the height of the Sobig-F pandemic last August one in 17 emails scanned by MessageLabs were viral. MessageLabs has blocked 33 million copies of SoBig-F, so MyDoom-A is the worst virus in terms of sheer weight of numbers too.

MyDoom-A was programmed to launch a denial of service attack against www.sco.com from infected machines. This – along with its spread – will cease today (see below for caveat*).

However the back door component of the virus has no time limit; it is still running on pox-ridden PCs.

Infected machines still need to be identified and decontaminated. This is doubly important because the recently-released Doomjuice worm uses this back door access to direct infected machines to packet Microsoft’s Web site.

MyDoom-A infected anything between 400,000 and one million PCs, according to sundry estimates from AV firms. On Tuesday, Feb 10, 67,000 IP addresses were actively scanning to and from port 3127, the back door left open by MyDoom-A, according to the SANS Institute's Internet Storm Center. This suggests many users have cleaned up their act.

Worst ever Windows worm - till the next one, anyway

MyDoom-A has outstripped Love Bug, SirCam and even Sobig-F in prevalence, but its overall impact is smaller than that of Slammer and Blaster. In scanning for fresh victims, Blaster generated copious quantities of traffic that had a measurable effect on Internet performance.

This is small comfort for the numerous users with prominent Net addresses, like us at The Reg. We were carpet bombed by the worm, whose email spoofing tactics created mass confusion and a tsunami of virus-related auto-responder spam.

Some AV packages have configurable alert responses but many AV systems will automatically send virus sender alerts to users who did not send the virus and are not infected. This causes more network traffic and waste valuable time as users look to disinfect uninfected machines. That's to say nothing of the wider legal and business implications of falsely accusing someone (potentially a business partner) of spreading a virus.

There are various theories about why MyDoom-A spread so rapidly. The multi-threaded nature of its spreading routines means that infected machines generated more crap. The worm was programmed to avoid sending itself to AV firms, Microsoft, government or the military – a tactic apparently designed to avoid the early detection of the worm. MyDoom used subtle social engineering tricks, for example impersonating standard email system messages, as a way of fooling unwary users into opening malicious attachments.

Some AV firms say the virus simply “got lucky”.

Forgive us if that doesn't make us feel any better - it’s only a matter of time before a similarly effective piece of malware is next released.

The effects of the worm raises yet again questions about the effectiveness of traditional AV scanner software. What SoBig-F and now MyDoom-A have shown is that these technologies are powerless at restraining a prolific email worm. ®

* The worm will stop packeting SCO and cease spreading from infected machines following the first system reboot after 02:28:57 GMT today. It will continue to spread from machines whose system clock is set incorrectly so what we'll see is MyDoom-A tailing off to background noise levels rather than disappearing entirely.

Related Stories

Latest Email worm (MyDoom) has SCO-facing payload
SCO posts $250,000 worm bounty
MyDoom assault forces SCO.com off the net
Worms pour through MyDoom back door
Sobig-F is fastest growing virus ever - official
And now we are One. Many unhappy returns to SoBig
Sobig-F blamed for massive increase in spam
Mafia recruiting spammers, crackers, AV chief warns
Virus writers outpace traditional AV
The trouble with anti-virus

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.