Feeds

Anatomy of a failed virus attack

It happened to me

SANS - Survey on application security programs

So what is this spammer trying to deliver? Opening up the zip file attachment reveals an apparent HTML file “zebwk.htm”, but on inspection it doesn't actually contain zebwk.htm, but a disguised .pif file. No problem for Linux, as it doesn’t use a mechanism which ties file the .PIF file extension to system functions, but on a Windows machine it would run when clicked, and if I forwarded the message to someone running a Windows Operating System it could potentially still do considerable damage.

There’s a lesson here. Technology can let you down. We run ClamAV, (an Open Source Anti-Virus Scanner) on our mailserver, but it didn't detect the Mytob Worm as this turned out to be in the zip file attached to the first forged e-mail. We later found that I had "received" about 20 variants of the message, and all but this one were dumped into a special virus quarantine mailbox by ClamAV before I even noticed, so perhaps this particular one was an new variant of the virus. All the other messages were correctly tagged and quarantined as containing malicious software.

For those interested, the lines of defence I mentioned earlier which we use are as follows:

  • Firewall on our external Internet gateway.
  • Undetectable Stealth firewall on our intranet gateway
  • Intrusion detection system constantly examines network traffic
  • Our MTA checks addresses on incoming email messages against known hostiles and rejects those that match
  • ClamAV scans all incoming email messages and quarantines them if malware is found
  • SpamAssassin scans incoming messages and performs vigorous analysis, filtering as necessary, its rules are automatically updated every 24 hours
  • Our desktop machines have their own firewalls enabled and set to block unauthorised traffic
  • We use Linux on all infrastructure machines, and Thunderbird for email with features set as noted earlier

Despite the considerable barrage of defences, a virus still found its way into my inbox. But was I compromised? No.

The moral of this story? Technology is a powerful tool to protect you, but it is not infallible. Security is a process, not something that you install and forget about. An informed and educated end-user is the best defence against this type of attack.

Follow up: Our main outstanding question was, “How did the single instance of this virus get though all our automated defences, whilst all the others were caught and dealt with? I forwarded the virus containing email to Jack on his suggestion, and ClamAV caught it this time – here’s the extract from the mail logfile:

XVirusReport: Worm.Mytob.IT2 FOUND XVirusCheckerVersion: clamassassin 1.2.2 with ClamAV 0.86.1/1134/Fri Oct 14 09:07:44 2005 signatures 34.1134

It was a different variant of the same worm, and as the ClamAV virus database updates overnight every 24 hours, they were just behind the new strain. This emphasises the point that you cannot rely on technology alone to protect you and your computing resources.

© Jim Kissel

Jim Kissel is a co-founder of Open Source Migrations Ltd, a UK company specialising in the development and marketing of 'Divorcing Windows', a complete methodology to enable businesses to migrate from Windows to Open Source Platforms. He can be reached at jim.kissel@osml.co.uk

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.