Sobig-F tops annual virus chart

By Matt Whipp

Posted on 3 Dec 2003 at 13:35

Sophos has announced its chart of virus activity for the year 2003, with August's Sobig-F accounting for 19.9 per cent of reports.

Hot on the heels of Blaster and Nachi, Sobig-F proved so rapacious that Sophos was receiving 400,000 copies a day - and not reports from worried users, but cases where a Sophos email address was in an infected computer's contact list.

Graham Cluley, senior technology consultant for Sophos said that, with the incredible spread of Sobig, 'it became a spam-like problem. In fact, we noticed the amount of spam actually reduced in that period.' He said even Mac OS and Unix users suffered the bandwidth wasting spam effects of Sobig.

With Sobig at number one, Blaster in second and Nachi in third place, August was by far the worst ever month for virus activity since viruses first appeared.

In fourth place, Gibe-F capitalised on the growing paranoia generated by the previous viruses to pose as a security patch from Microsoft. Cluley said that the virus was so convincing, there were cases of people manually forwarding the virus to friends, thinking they were doing a good turn.

Of the ten charting viruses, all but those at positions two and three relied on executable code in email attachments. Cluley said this strengthens the case for companies to adopt a policy of not accepting such email and screening it out at the email gateway.

He said large numbers of infected or insecure computers were being used as open proxies - as much as 30 per cent of spam is being sent through these hijacked machines. And he expects the future to hold more of those 'blended' viruses which are not only mass-mailing worms, but also contain backdoor Trojans that give remote access to an infected computer.

This is often done through IRC channels, used by instant messaging services, which users keep open because of course these services are useful to them. Cluley said he expected viruses to continue to target this method of backdoor control in the future.

However, he didn't expect to see an explosion of viruses for the latest sophisticated phones and PDAs: Windows viruses are so effective and so easy to create that few virus writers would see the effort of creating a virus for a new platform as worthwhile.

What virus writers will be doing, thinks Cluley, is 'working closer and closer with spammers'. Sophos has seen spam double since 5 October of this year. 'I don't think that any legislation will completely cut out spam,' he said, adding that the 'US legislation actually encourages it.'

The Anti-spam bill going through in the states plumps for an 'opt out' system, where spammers can continue to send emails unless the recipients explicitly opt out of doing so. Currently methodology advises not to do so; that replying to spam mail is one sure way to validate your email address. In Europe, the situation is hardly any better. Although we have adopted an 'opt in' system, you can still send emails out to those with whom you have an existing relationship - which could be read as, if you're already spamming someone, you can keep on doing it.

'Spam has made computing less fun,' lamented Cluley, noting that there aren't similar problems associated with other consumer electronics kit as there are with a computer.