Feeds

Anatomy of a failed virus attack

It happened to me

Top three mobile application threats

So what is this spammer trying to deliver? Opening up the zip file attachment reveals an apparent HTML file “zebwk.htm”, but on inspection it doesn't actually contain zebwk.htm, but a disguised .pif file. No problem for Linux, as it doesn’t use a mechanism which ties file the .PIF file extension to system functions, but on a Windows machine it would run when clicked, and if I forwarded the message to someone running a Windows Operating System it could potentially still do considerable damage.

There’s a lesson here. Technology can let you down. We run ClamAV, (an Open Source Anti-Virus Scanner) on our mailserver, but it didn't detect the Mytob Worm as this turned out to be in the zip file attached to the first forged e-mail. We later found that I had "received" about 20 variants of the message, and all but this one were dumped into a special virus quarantine mailbox by ClamAV before I even noticed, so perhaps this particular one was an new variant of the virus. All the other messages were correctly tagged and quarantined as containing malicious software.

For those interested, the lines of defence I mentioned earlier which we use are as follows:

  • Firewall on our external Internet gateway.
  • Undetectable Stealth firewall on our intranet gateway
  • Intrusion detection system constantly examines network traffic
  • Our MTA checks addresses on incoming email messages against known hostiles and rejects those that match
  • ClamAV scans all incoming email messages and quarantines them if malware is found
  • SpamAssassin scans incoming messages and performs vigorous analysis, filtering as necessary, its rules are automatically updated every 24 hours
  • Our desktop machines have their own firewalls enabled and set to block unauthorised traffic
  • We use Linux on all infrastructure machines, and Thunderbird for email with features set as noted earlier

Despite the considerable barrage of defences, a virus still found its way into my inbox. But was I compromised? No.

The moral of this story? Technology is a powerful tool to protect you, but it is not infallible. Security is a process, not something that you install and forget about. An informed and educated end-user is the best defence against this type of attack.

Follow up: Our main outstanding question was, “How did the single instance of this virus get though all our automated defences, whilst all the others were caught and dealt with? I forwarded the virus containing email to Jack on his suggestion, and ClamAV caught it this time – here’s the extract from the mail logfile:

XVirusReport: Worm.Mytob.IT2 FOUND XVirusCheckerVersion: clamassassin 1.2.2 with ClamAV 0.86.1/1134/Fri Oct 14 09:07:44 2005 signatures 34.1134

It was a different variant of the same worm, and as the ClamAV virus database updates overnight every 24 hours, they were just behind the new strain. This emphasises the point that you cannot rely on technology alone to protect you and your computing resources.

© Jim Kissel

Jim Kissel is a co-founder of Open Source Migrations Ltd, a UK company specialising in the development and marketing of 'Divorcing Windows', a complete methodology to enable businesses to migrate from Windows to Open Source Platforms. He can be reached at jim.kissel@osml.co.uk

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.