* Sober worm spread quickly
Underscoring the fact that the virus problem is in many ways getting worse (at least periodically) is the fact that as I write this column one out of every seven e-mail messages sent worldwide contains a virus, and the vast majority of those are some variant of the Sober worm.
Postini is reporting that of 16 million viruses it has stopped in the past 24 hours, 14.7 million of these are the Sober worm. MX Logic reports that 14% of all e-mail traffic it is processing right now contains Sober, and that this worm represents 88% of all viruses and worms it is capturing. In the first 27 hours after Sober was discovered, MessageLabs stopped 1.1 million copies.
Sober is a mass-mailing worm that uses a ZIP file in an e-mail message and was first discovered May 2. Users of domains in English-speaking countries receive a variety of messages in the subject line about computer or password problems. For recipients using domains that are used primarily in German-speaking countries, the e-mail that contains the worm tells recipients they have won tickets to the upcoming World Cup. Clicking on the ZIP file spreads the worm.
Although the number of virus-laden messages typically ebbs and flows due to a variety of factors, MX Logic reports that on May 4, the number of Sober-tainted messages increased by 100% as European users came online, indicating that the subject-line advertising World Cup tickets was particularly effective in luring unsuspecting users.
The rapid spread of Sober points out the critical need for better virus protection, particularly in enterprises that might suffer significant productivity loss as IT scrambles to repair infected systems. Because there is always a lag between the introduction of a new virus and the creation of a signature to thwart it – and sometimes an even longer period between the creation of the signature and its deployment – all users, from enterprises on down, need protection before a signature is available. Such “zero-hour” protection is available from some vendors to quarantine messages that look like they might contain viruses. These messages then sit in quarantine until a signature is created to clean them.
In the meantime, additional user education is clearly needed. Users need to understand and follow good e-mail practices, such as not clicking on ZIP files from unknown sources. While this seems obvious to most of us, the rapid spread of the Sober worm indicates that it’s not so obvious to many.
