Feeds

Anatomy of a failed virus attack

It happened to me

Choosing a cloud hosting partner with confidence

So what is this spammer trying to deliver? Opening up the zip file attachment reveals an apparent HTML file “zebwk.htm”, but on inspection it doesn't actually contain zebwk.htm, but a disguised .pif file. No problem for Linux, as it doesn’t use a mechanism which ties file the .PIF file extension to system functions, but on a Windows machine it would run when clicked, and if I forwarded the message to someone running a Windows Operating System it could potentially still do considerable damage.

There’s a lesson here. Technology can let you down. We run ClamAV, (an Open Source Anti-Virus Scanner) on our mailserver, but it didn't detect the Mytob Worm as this turned out to be in the zip file attached to the first forged e-mail. We later found that I had "received" about 20 variants of the message, and all but this one were dumped into a special virus quarantine mailbox by ClamAV before I even noticed, so perhaps this particular one was an new variant of the virus. All the other messages were correctly tagged and quarantined as containing malicious software.

For those interested, the lines of defence I mentioned earlier which we use are as follows:

  • Firewall on our external Internet gateway.
  • Undetectable Stealth firewall on our intranet gateway
  • Intrusion detection system constantly examines network traffic
  • Our MTA checks addresses on incoming email messages against known hostiles and rejects those that match
  • ClamAV scans all incoming email messages and quarantines them if malware is found
  • SpamAssassin scans incoming messages and performs vigorous analysis, filtering as necessary, its rules are automatically updated every 24 hours
  • Our desktop machines have their own firewalls enabled and set to block unauthorised traffic
  • We use Linux on all infrastructure machines, and Thunderbird for email with features set as noted earlier

Despite the considerable barrage of defences, a virus still found its way into my inbox. But was I compromised? No.

The moral of this story? Technology is a powerful tool to protect you, but it is not infallible. Security is a process, not something that you install and forget about. An informed and educated end-user is the best defence against this type of attack.

Follow up: Our main outstanding question was, “How did the single instance of this virus get though all our automated defences, whilst all the others were caught and dealt with? I forwarded the virus containing email to Jack on his suggestion, and ClamAV caught it this time – here’s the extract from the mail logfile:

XVirusReport: Worm.Mytob.IT2 FOUND XVirusCheckerVersion: clamassassin 1.2.2 with ClamAV 0.86.1/1134/Fri Oct 14 09:07:44 2005 signatures 34.1134

It was a different variant of the same worm, and as the ClamAV virus database updates overnight every 24 hours, they were just behind the new strain. This emphasises the point that you cannot rely on technology alone to protect you and your computing resources.

© Jim Kissel

Jim Kissel is a co-founder of Open Source Migrations Ltd, a UK company specialising in the development and marketing of 'Divorcing Windows', a complete methodology to enable businesses to migrate from Windows to Open Source Platforms. He can be reached at jim.kissel@osml.co.uk

Beginner's guide to SSL certificates

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
US government fines Intel's Wind River over crypto exports
New emphasis on encryption as a weapon?
To Russia With Love: Snowden's pole-dancer girlfriend is living with him in Moscow
While the NSA is tapping your PC, he's tapping ... nevermind
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Slap for SnapChat web app in SNAP mishap: '200,000' snaps sapped
This is what happens if you hand your username and password to a 3rd-party
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.