IT Employment

Ask something
Discussion Locked

Slandered by Sobig Virus!!

0 helpful
5 replies

by oldefar

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am posting this in Management rather than Security because of where the impact occurs.

Joseph Moore posted on how an old virus spread via Blaster. Another poster, rsiccs@hotmail.com, recommends a hard line reaction to the spread of email viruses and spam.

The Sobig.f virus has the potential to turn approaches to spammers and virus spreaders into business disruption via self inflicted actions. Sobig.f spoofs the source address as it replicates itself via the infected user's address book, randomly using addresses from the address book as the spoofed source. The result is that innocent email users appear as having the Sobig.f virus.

A number of companies use an appliance or service to catch viruses spread by email and to block spam. Examples include the WorldSecure approach from Tumbleweed and MailWatch service. As part of the service, reports of addresses that sent viruses or spam are generated.

When such reports are made available to managers who may not understand how particular viruses work, the potential exists for incorrectly identifying particular domains or users as either unsecured or as spammers. Submitting such reports to black hole listing services may result in these domains being blocked by well intentioned administrators. In effect, businesses may inflict damage on each other independent of but due to a virus.

At a minimum I can imagine making a call on a potential client in the next several days, perhaps after the August email reports are generated. The client recognizes my company name as having been a source of virus infected email, and assumes that my company fails to take security precautions. My ability to show the value I can bring his company may be severely impaired because someone with my company email address in their address book was infected.

So far at five firms that I have never done business with, who are nowhere in my address book, have sent automated responses to me that I sent an infected email to one of their users. How many other companies received Sobig.f in an email using my company email address as sender?

I urge all of you involved with infrastructure security to advise your users ? the Sobig.f virus spoofs the sending address and not to assume that the sender name was that of the real infected machine. Don?t let the virus get away with slandering individuals or companies. Do it because your company may also have been slandered.

5 replies

by cactus pete

Some people never delete old contact information... You know, just in case they ever need to find someone like that again.

A couple of years ago, I picked up a domain name from a company that had been purchased by another, larger company. Their company name happened to be my name, so I grabbed it.

I am now getting those automated responses from other companies related to that industry with old usernames from the now defunct entity.

I wonder just how many degrees of separation this phenomenon can cover.

by oldefar

1 billion mailboxes. Probably around 300 to 500 million users. An average of about 100 address book entries per user.

There is probably less than three degrees of seperation between any online user as far as email viruses go.

by dc guy

This needs to be announced in the popular press, not just the trade press. People who use the Internet for business but have no IT expertise beyond that could have their businesses adversely affected and not even know what's happening. ... This just points out the need for digital signature authentication. ... The Internet is the Wild West. No rules, no authorities, no scruples, no protection.

by oz_media

I came in this morning and looked at my tons of returned 'undeliverable' mail that I hadn't sent and was going to post an article but then thought this one was close enough, nice to know I'm not alone!

I maintain two networks for relatively large businesses in BC. They have great PSAM protection as well as constantly updated virus signature files (via me).

I had about 20 returned emails (as sys admin) and cna't see ANY of the 'to' addresses as being in any of the staff address books. I'm sure I'll spend a few days when this is all over clearing thier domains from Black Lists.

All machines at both companies have been scanned with AV and Trojan tools and found to be clean. Manual registry checks on the key machines are fine also.

You are right in saying that this will put many relevant and secure companies on those dreaded black lists (some of which are run by kiddies) and will make it hard to be removed as they are GroupWise email servers. In GW servers the mail APPEARS to be relayed and thus open relay notifications are sent out before hitting blacklists. All that happens is GW will accept relayed mail but not execute the relay. This has also been patched but can still appear to 'the kiddies' as an open relay server. It took me several months to get one compamy cleared from a blacklist in the past because the owners of the BL simply didn't underastand GW and didn't believe it wasn't relaying mail. They eventually pulled the domain off after speaking with my lawyers.

So, I see another problem on top of the inproperly blacklisted domains, convincing the said black listers that your domains are secure.

What a pain in the ass, using GW ususally provides immunity from such attacks, whereas the Exchange users have always been targeted.
I used to be able to sit and surf bands sites while everyone else was fixing Exchange networks, this one has hit EVERYONE and simply is a nuisance more than system destructive.

by generalist

Every few days for the last few months I've been receiving "Undeliverable mail" at one of my e-mail accounts. The organization appears to be some sort of Asian porn group that is using my e-mail address as a return address while systematically probing various ISPs.

If this happened to more people, I suspect that there would be an effort to pass laws and take action against cyber-identity theft. Of course, enforcing it internationally would be a joke.

This discussion is closed to new replies.