Computer Crime Research Center


Sober worm strikes as FBI, CIA email

Date: November 23, 2005
Source: Red Herring

The Sober email worm that first struck in 2003 has made another comeback through a variant disguised as an email from the U.S. Federal Bureau of Investigation or the Central Intelligence Agency, becoming one of the fastest-spreading security threats in the last 24 hours, security software companies said Tuesday.

The worm is not considered highly dangerous as it does not seek to steal personal or financial information, but it can make infected computers susceptible to future viruses, which could potentially be more worrisome.

The first incidence of the latest Sober variant was detected Monday, said Patrick Hinojosa, chief technical officer of Panda Software, a Spanish security software company.

“Just a few hours after emerging, Sober.AH is already one of the viruses most frequently detected by our online antivirus solution,” he said. “For something that is not an Internet worm but one that infects through email, the spread rate on it is very steep.”

In the last four hours, the worm has accounted for more than 61 percent of all virus and worm threats reported to Sophos, a United Kingdom-based threat management software maker. Sophos said the latest variant of Sober makes it the most prevalent virus spreading across the world.

MessageLabs, another provider of managed email security services to businesses worldwide, has intercepted more than 2.7 million copies of the new Sober mutant since Monday.

The latest Sober variant reaches computers as an attachment to an email message purporting to be a warning from the FBI and advising users they have accessed illegal Internet addresses. The email appears to be sent from the email addresses of [email protected], [email protected], and [email protected]

“This variant of the Sober worm may catch the unwary as they open their email inbox this morning,” said Graham Cluley, senior technology consultant at Sophos. “Every law-abiding citizen wants to help the police with their enquiries, and some will panic that they might be being falsely accused of visiting illegal web sites and want to click on the unsolicited email attachment.”

The worm can send itself in email messages in either English or German depending on the intended recipient’s address. If a user runs the file containing the worm, a window is displayed with a false error message. While this is happening, the worm sends itself to all email addresses it can find on the infected computer.

Terminates Processes

In addition, the worm terminates processes running on the system belonging to certain applications, including some security solutions. Every time it does this, it displays a dialogue box saying that no viruses, Trojans, or spyware were found. The aim is to leave the computer unprotected against future attacks, said Panda Software.

This damage is significantly lower than what could have been possible, said security experts. The Sober variant does not create backdoor entries into an infected computer or steal financial or personal information. Nor does it turn the computer into a zombie that can be used to relay spam.

“It is an email worm without any major payload as far as directly damaging the computer,” said Panda Software’s Mr. Hinojosa. “It creates an infection but the only real damage it does at this point is clogging the communication lines.”

This is in contrast to the trend of “business worms” that security companies have been noticing this year. The Internet worm Zotob, which attacked major corporations in August by exploiting a vulnerability in Microsoft’s Windows operating system, was an example of a new type of malicious software that targets enterprises rather than home users (see Zotob Heralds Business Worm).

“It would have been easy to create a payload on this Sober variant,” said Mr. Hinojosa. “But probably someone wanted to see how fast it could spread and was looking for notoriety rather than any financial gain,” said Mr. Hinojosa.

Orange Alert

Meanwhile, the FBI issued a warning on Tuesday about the worm telling users it does not come from the FBI.

“Recipients of this or similar solicitations should know that the FBI does not engage in the practice of sending unsolicited emails to the public in this manner,” the agency said in a statement.

The FBI has said that it is investigating the worm and has asked users receiving these emails to report it to the Internet Crime Complaint Center.

Panda Software has issued an orange alert against the worm, the highest being the red alert.

The Sober worm first surfaced in 2003 and since then has undergone more than 30 variations to become one of the most frequently detected security threats.
Original article

Add comment  Email to a Friend

Discussion is closed - view comments archieve
2009-11-07 13:30:41 - selamın aleyküm kardeşlerim... tuncay kangal
2009-05-27 04:46:36 - merhaba ben mesut kibar 18... mesut
2009-02-15 09:14:37 - tuncaykangal
2009-02-15 08:56:25 - kardeşlerim selamın aleyküm ben... tuncaykangal
2008-01-01 04:49:57 - Allah katında tek ve hak din... tuncaykangal
2007-12-20 08:16:39 - DİNLER ARASI DİYALOG VE ILIMLI... tuncaykangal
2007-12-20 08:09:06 - KARDEŞLERİM... tuncaykangal
2007-12-20 08:05:22 - KARDEŞLERİM BENİM SEKS... tuncaykangal
2007-12-20 07:42:29 - ALLAH KATINDA TEK VE HAK DİN... tuncaykangal
2007-12-20 07:40:50 - HEPİMİZ TANRI'NIN ÇOCUKLARIYIZ... tuncaykangal
Total 92 comments
Copyright © 2001-2013 Computer Crime Research Center
CCRC logo