Feeds

Anatomy of a failed virus attack

It happened to me

5 things you didn’t know about cloud backup

So what is this spammer trying to deliver? Opening up the zip file attachment reveals an apparent HTML file “zebwk.htm”, but on inspection it doesn't actually contain zebwk.htm, but a disguised .pif file. No problem for Linux, as it doesn’t use a mechanism which ties file the .PIF file extension to system functions, but on a Windows machine it would run when clicked, and if I forwarded the message to someone running a Windows Operating System it could potentially still do considerable damage.

There’s a lesson here. Technology can let you down. We run ClamAV, (an Open Source Anti-Virus Scanner) on our mailserver, but it didn't detect the Mytob Worm as this turned out to be in the zip file attached to the first forged e-mail. We later found that I had "received" about 20 variants of the message, and all but this one were dumped into a special virus quarantine mailbox by ClamAV before I even noticed, so perhaps this particular one was an new variant of the virus. All the other messages were correctly tagged and quarantined as containing malicious software.

For those interested, the lines of defence I mentioned earlier which we use are as follows:

  • Firewall on our external Internet gateway.
  • Undetectable Stealth firewall on our intranet gateway
  • Intrusion detection system constantly examines network traffic
  • Our MTA checks addresses on incoming email messages against known hostiles and rejects those that match
  • ClamAV scans all incoming email messages and quarantines them if malware is found
  • SpamAssassin scans incoming messages and performs vigorous analysis, filtering as necessary, its rules are automatically updated every 24 hours
  • Our desktop machines have their own firewalls enabled and set to block unauthorised traffic
  • We use Linux on all infrastructure machines, and Thunderbird for email with features set as noted earlier

Despite the considerable barrage of defences, a virus still found its way into my inbox. But was I compromised? No.

The moral of this story? Technology is a powerful tool to protect you, but it is not infallible. Security is a process, not something that you install and forget about. An informed and educated end-user is the best defence against this type of attack.

Follow up: Our main outstanding question was, “How did the single instance of this virus get though all our automated defences, whilst all the others were caught and dealt with? I forwarded the virus containing email to Jack on his suggestion, and ClamAV caught it this time – here’s the extract from the mail logfile:

XVirusReport: Worm.Mytob.IT2 FOUND XVirusCheckerVersion: clamassassin 1.2.2 with ClamAV 0.86.1/1134/Fri Oct 14 09:07:44 2005 signatures 34.1134

It was a different variant of the same worm, and as the ClamAV virus database updates overnight every 24 hours, they were just behind the new strain. This emphasises the point that you cannot rely on technology alone to protect you and your computing resources.

© Jim Kissel

Jim Kissel is a co-founder of Open Source Migrations Ltd, a UK company specialising in the development and marketing of 'Divorcing Windows', a complete methodology to enable businesses to migrate from Windows to Open Source Platforms. He can be reached at jim.kissel@osml.co.uk

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.