SoBig a nuisance
Connecting state and local government leaders
It is not the fastest spreading worm ever and it is not the most destructive, but for sheer nuisance value the latest variant of SoBig has to rank at the top of the list. <br>
It is not the fastest spreading worm ever and it is not the most destructive, but for sheer nuisance value the latest variant of SoBig has to rank at the top of the list.
'It sends virus and spam through Simple Mail Transfer Protocol extremely often,' said Eric Kwon, CEO of Global Hauri Inc. of San Jose, Calif.
SoBig.F, which appeared Tuesday, uses spoofed e-mail addresses to send frequent mass mailings. Many antivirus programs will generate e-mail messages to both the recipient and supposed sender when an infected e-mail is discovered, as well as to administrators. In some cases notices of undeliverable mail also are generated.
'The real problem is that SoBig.F potentially brings down the network' through sheer volume of e-mail, Kwon said.
'It started hitting us hard and heavy yesterday morning,' said Commerce Department CIO Tom Pyke. 'In the last day and a half, in the e-mail system for the 1,000 people in the office of the secretary, we have filtered out and cleaned more than 40,000 e-mail messages that contained the SoBig virus.'
The rate is not slowing, he said. 'We are still seeing 500 to 700 incoming e-mails from around the world every hour' at the office of the secretary, Pyke said. He estimated the other 3,000 employees in the department's Washington headquarters were receiving infected e-mail messages at a similar rate.
So far the headquarters has avoided infection. The e-mails are being quarantined so that they do not show up on the recipients' desktops, and the antivirus software is not sending notifications. So despite the onslaught, 'for users in our building, it's business as usual,' Pyke said.
During the time before new virus definitions were available for the department's McAfee antivirus software from Network Associates Inc., 'we simply put out a note for people not to open attachments,' Pyke said.
The first signature files made available were for servers, which allowed blocking at that level. When desktop definitions became available, they were pushed to 40,000 desktops across the department.
Pyke is proud of the department's response, but said IT defense is an ongoing effort. 'You've got to keep on your toes.'
NEXT STORY: Court official charges Interior destroyed data