Sobig 'Carpet Bombs' the Internet

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Sobig-F, which has been causing chaos on corporate networks the past three days, is now

being called the fastest spreading virus in the industry’s history.

”It was a carpet bombing,” says Chris Belthoff, a senior security analyst with Lynfield,

Mass.-based Sophos Inc., an anti-virus company. ”We’re judging this to be the fastest

spreading worm ever, even surpassing Klez and LoveBug. This is really just a complete

swamping, or inundation, of networks… Companies are having their email systems taken down

because of the sheer volume of emails they’re getting. It’s a slow down, then a slow to a

crawl and then just being taken offline.”

Sobig-F, which first appeared this past Monday as the latest member of the malicious Sobig

virus family, hit the Internet hard, flooding email servers and inboxes. Corporate networks

staggered under the barrage with network access slowing to a crawl, and some email systems

being taken temporarily offline to stop the siege.

AOL saw email traffic nearly quardruple yesterday, according to Nicholas Graham, an AOL

spokesman. Graham says AOL scans email attachments at the gateway, checking for viruses. On

an average day, the ISP scans approximately 11 million attachments. On Wednesday, the staff scanned 40.5 million email attachments and found 23.7 of those to be infected with viruses. Of those, 23.2 million were infected with Sobig-F.

”People are just getting pummeled, either with the virus or with notifications,” says MJ

Shoer, president and chief technology officer of Jenaly Technology Group, Inc., an IT

provider and consultant based in Portsmouth, N.H. ”We’re just getting beaten on. One of our

clients is seeing a 90 percent increase in email messages. In the case of my mailbox, it’s

close to 70 percent. And I have a firewall, a spam and content filter and anti-virus.”

And Shoer says the virus attack is bringing regular work to a standstill.

”It’s rendered IT staffs useless,” he adds. ”They’re just flooded. If there was going to

be a rollout or something, it’s just not getting done. We’re putting off everything that was

a high priority.”

Shoer also noted that he talked to an IBM engineer on Wednesday who wasn’t able to offer him

customer service because his email was down. Security analysts verified IBM’s troubles but

the company could not be reached for comment and its Web site was unresponsive Wednesday

afternoon.

”A lot of corporations and universities had to literally shut down their email networks

because of the huge volume of traffic of inbound Sobig emails and bounced email messages,”

says Steve Sundermeier, vice president of products and services at Central Command Inc., an

anti-virus company based in Medina, Ohio. ”If you’re talking about a large corporation — a

Fortune 100 or a Fortune 200 — and you take down an email system for an hour, it could cost

that corporation a million dollars.”

But three different security experts say the Sobig-F assault seems to have peaked yesterday

afternoon, when the malicious email was accounting for at least 70 percent of all email

flowing around the world. Today, the number is still high but most estimate that it has

dropped down into the 60 percent to 70 percent range.

Sophos’ Belthoff says the virus, which is a mass-mailing worm that also can spread via

network shares, hit the Net so hard so quickly because of the spam-like spreading technique

that the author used.

”They carpet bombed the Internet and played the numbers game,” says Belthoff. ”There were

just millions of copies out there hitting the Internet all at the same time. It’s a matter

of sending out enough copies so that somebody will click on it. When you send out that many,

even a small percentage of a response, is going to make for a successful virus.”

But other security analysts say the virus is hitting the Internet so hard because it is

building on the impact of its Sobig predecessors.

Sundermeier explains that earlier variants of Sobig have infected computers and then

downloaded Trojans to set the machines up to be hidden proxy servers. ”The author has a

huge army now for the next seeding,” he says. ”Every Sobig variant becomes bigger and

bigger, and we believe it’s because of this army he’s building of infected machines.”

Sobig-F is designed to die out on Sep. 10. That’s leading many analysts to suspect that the

next variant will hit on Sep. 11 or soon after. And if that variant builds on the malicious

success of Sobig-F, then the damage could be even worse.

AOL’s Graham says they are already planning defenses for the next Sobig attack. ”We’re already gearing up for the next variant, Sobig-G, if you will,” he says.

When the worm arrives via email, it poses as a .pif or .scr file. The sender’s address is

spoofed. The subject lines used are taken from a list, including ‘Re: That movie’, ‘Re:

Wicked screensaver’, ‘Re: Approved’ and ‘Your details’.