Sobig's Secondary Attack.

[Dr Halonfires LesGirl]

Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !

Read the full story
at http://psi.5544.net
NEW SECTION:-
Virus Alerts LIVE from Sophos !
ALSO
Also : Bush is Out of His Tree !!!
And much more.

 

[Karel]

Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !

Read the full story
at http://psi.5544.net
NEW SECTION:-
Virus Alerts LIVE from Sophos !
ALSO
Also : Bush is Out of His Tree !!!
And much more.

PLOINK

 

[Karel]

It is true, it is like watching a thriller movie.

This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml

Jari

I better make a phonecall to Jari Litmanen to translate this one for me

What is the big deal now? Something new? I don't think so!

 

[null]

I better make a phonecall to Jari Litmanen to translate this one for me

Save yourself the money:

http://www.f-secure.com/news/items/news_2003082200.shtml

What is the big deal now? Something new?
Yep.

I don't think so!

Non-believer!




Art
http://www.epix.net/~artnpeg

 

[Kimmo K. Kolari]

Check URL: http://www.f-secure.fi/news/items/news_2003082200.shtml

 

[Karel]

Save yourself the money:

http://www.f-secure.com/news/items/news_2003082200.shtml


Non-believer!

Non panicer would be more right

Quote:

The worm spreads itself via infected e-mail attachments in e-mails with

a spoofed sender address.
Nothing new to this.

All the infected computers are entering a second phase today, on Friday

the 22nd of August, 2003. These computers are >using atom clocks to
synchronize the activation to start exactly at the same time around the
world: at 19:00:00 UTC (12:00 in >San Francisco, 20:00 in London, 05:00
on Saturday in Sydney).

Nothing new to this except the atomclock part.
In my opinion you must run the atomclock program to be exactly on time,
is sobig.f able te execute it?
I have it on my PC

On this moment, the worm starts to connect to machines found from an

encrypted list hidden in the virus body. The list >contains the address
of 20 computers located in USA, Canada and South Korea.

And these PC's must all be online at 19.00 UTC. What if they decide to
be online at 19.30 UTC?

Ok enough room for discussion. I am ever sceptic about warnings like
this. To me it seems to be a bit panic-ball.

 

[Jari Lehtonen]

I better make a phonecall to Jari Litmanen to translate this one for me

What is the big deal now? Something new? I don't think so!

Sorry, I copied the Finnish address - sily me!
http://www.f-secure.com/news/items/news_2003082200.shtml

jari

 

[Karel]

..

You skipped over the interesting part which gives a flavor of mystery
to the thing. Nobody knows what's going to happen at the appointed
time.

So the mystery part if the new thing?

Do you have DSL service? Are you "infected"?

Yes, 1500k to be precise.
No I am not infected, at least there are no signs of any rash.

Maybe the "chosen ones" are on all the time.

So you must be part of the happy few that are both infected and chosen?
Why they don't choose me for once.
I even don't get one infected e-mail although my valid e-mail adress is
all over use-net.

Ok enough room for discussion. I am ever sceptic about warnings like

This one didn't strike me as panic-ball or silly hype. I found it at
least slightly interesting.

Interesting it is, with this I agree with you Art. But panic-ball it
remains in my opinion like all virus strikes.

 

[null]

So the mystery part if the new thing?

It's the first time I've heard of this particular scenario,

Do you have DSL service?
Yes.

Are you "infected"?
Nope.


So you must be part of the happy few that are both infected and chosen?

Nope. Just interested.

Interesting it is, with this I agree with you Art. But panic-ball it
remains in my opinion like all virus strikes.

Not all utterances from antivirus vendors are "panic-ball"


Art
http://www.epix.net/~artnpeg

 

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yes. That's my understanding.

That's not how I understood it... I think it's the *20 servers* that
have it -- so it starts at EXACTLY the same moment.

My favorite part of the F-Secure article is this paragraph:

"The advanced techniques used by the worm make it quite obvious it’s
not written by a typical teenage virus writer. The fact that previous
Sobig variants we’re used by spammers on a large scale adds an
element of financial gain. Who’s behind all this? “Looks like
organized crime to me”, comments Mikko Hypponen."
http://www.f-secure.com/news/items/news_2003082200.shtml

Organized crime? That's hilarious! Oh, how I wish Rob Rosenberger was
back from fighting the *real* war to see all this! He'd love it! ;-)

I haven't received the worm -- just the e-mail. Two-hundred-sixty, so
far. Increasing by the minute. ;-)

Wonder what it's supposed to do, today? Wouldn't it be funny if all
it did was just put up a graphic on the screen that says, "Psyche!
Serves ya right for not patching your pc and for executing unknown
attachments!"

(Flames via e-mail.)

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Because I *can* be.

iQA/AwUBP0Zz46RseRzHUwOaEQLr1gCgyKuVh7d86Itzbo8q5PIVAUpCuooAnjne
if5C8AQyYdcJ30AtF9VD/O3h
=qdUV
-----END PGP SIGNATURE-----

--
Laura Fredericks
PGP key ID - DH/DSS 2048/1024: 0xC753039A

http://www.queenofcyberspace.com/usenet-fact.jpg

Remove CLOTHES to reply.

 

[Karel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Skip

Thanks for the moral support.

 

[Bart Bailey]

In Message-ID:<uss1b.24343$KF1.318566@amstwist00> posted on Fri, 22 Aug

Ok enough room for discussion. I am ever sceptic about warnings like
this. To me it seems to be a bit panic-ball.

When I see those type warnings, I feel a twinge of hope that maybe this
time it will amount to something other than bullshit.
Not that I wish all the world's computers to crash
(might be interesting)
but that I would enjoy the surprise of having a bit of truth in the dire
warnings that always precede such non events.
Remember Y2K?

 

[null]

In Message-ID:<uss1b.24343$KF1.318566@amstwist00> posted on Fri, 22 Aug


When I see those type warnings, I feel a twinge of hope that maybe this
time it will amount to something other than bullshit.
Not that I wish all the world's computers to crash
(might be interesting)
but that I would enjoy the surprise of having a bit of truth in the dire
warnings that always precede such non events.
Remember Y2K?

Maybe you'd get some jollies out of this one then:

http://www.cs.wisc.edu/~plonka/netgear-sntp/


Art
http://www.epix.net/~artnpeg

 

[Julie Brandon]

Remember Y2K?

Does it occur to you that not a lot happened because a lot of companies
took the warnings seriously and acted upon them?

I know personally that some companies, like IBM for instance, recognized,
and were dealing with, the issue from at least as far back as 1990 and very
probably earlier.

Similarly, today's SoBig-F panic has been about getting those 20 master
servers offline before things went into action. Last I heard, they had only
one left to deal with; if they succeeded, then the mass trojan download will not
be happening (at least for now, as unfortunately we gather that the virus
writer can update this list of servers, so it may turn into a cat and mouse
game.)

So, if those screaming out the warnings succeed in warning people and making
sure action is taken, and then because of that the sh*t doesn't hit the fan,
everyone then points fingers at them and says that they overreacted. It
seems to be that its an "any which way but lose" situation.

Ta-ra,

 

[Hurricane Andrew]

Maybe the chosen ones, like the majority of modern PCs, can turn themselves
on and off. As well being able to turn off when you ask Windows to
shutdown, many BIOSs give you the option of having a set time/date for the
computer to come on. Possibly the chosen machines have had their config
hacked to do this?

Possible, but I'd love to see a PC turn itself on without a power cord
attached

 

[Tomi M]

: In Message-ID:<[email protected]> posted on
: Fri, 22 Aug 2003 16:48:48 GMT, (e-mail address removed) wrote:

F-secure reported 1950 UCT that they have not been able to
contact the machines spreading the new executable. 18 UCT
they mentioned that only one of the servers respond to
ping.

I just runned 2015 UCT a ping on all of the listed machines
and 9 of them answered to ping. So it seems that at least
some of the machines are now up. I have no idea if they are
already spreading the virus.

Tomi


: From the write up:
: ---begin---
: All the infected computers are entering a second phase today, on Friday
: the 22nd of August, 2003. These computers are using atom clocks to
: synchronize the activation to start exactly at the same time around the
: world: at 19:00:00 UTC (12:00 in San Francisco, 20:00 in London, 05:00
: on Saturday in Sydney).
: ---end---
: well, it's 1953 UTC and nothing has happened yet <g>
: --

: Bart

 

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks for the moral support.

I have no sympathy for people who execute unknown attachments, or use
an e-mail program and/or newsreader that can render messages in
potentially-evil HTML, or don't patch their machines and get a virus.
Ditto for those who visit dubious websites, or download warez and get
a virus.

If you're driving your car without a spare tire and you get a flat --
whose fault is it?

If the weather forecaster says "rain today" and you don't take an
umbrella and get wet -- whose fault is it?

Etcetera... <yawn>

Blaming the software companies is a moot point. Computer systems and
programs aren't infallible, because they were written by HUMANS.
Humans aren't perfect and make mistakes.

Blaming the virus writers is a moot point. People are *going* to
exploit computer OS and programs. It's human nature. Whether for
damage, notoriety or plain ol' fun... They do it because they *can*.
;-)

Therefore, there's no one left to blame but...

Here's one of my favorite quotes:

"We are taught you must blame your father, your sisters, your
brothers, the school, the teachers -- but never blame yourself. It's
never your fault. But it's always your fault, because if you wanted
to change you're the one who has got to change."
- -Katharine Hepburn

(Sleep well, dear Katharine. We miss you.)

It's a big, tough world (wide web) out there. It's up to YOU to
protect yourself.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Because I *can* be.

iQA/AwUBP0aF26RseRzHUwOaEQKWmACg2KfwGn8FBZW0RngQ6KWeyNgmIbYAoNHq
2paK65ZAY6+TfL/qoRD/osNv
=BPMP
-----END PGP SIGNATURE-----

--
Laura Fredericks
PGP key ID - DH/DSS 2048/1024: 0xC753039A

http://www.queenofcyberspace.com/usenet-fact.jpg

Remove CLOTHES to reply.

 

[Dr Halonfires LesGirl]

I can send you a copy of the 1 infected email I recieved today if you like.
When the Sobig worm connects to the server and distributes Sobig-G possibly,
in a mass-mailing campaign combined with a denial-of-service attack on M$
maybe, or whatever it does; then people like you will be asking people like
me why we didn't make a stronger case.

 

[Dr Halonfires LesGirl]

I'd love to Laura; yours too.

Well said BTW; 'couldn't agree more.

 

[Julie Brandon]

Possible, but I'd love to see a PC turn itself on without a power cord
attached

Hehehe.

To be fair though, how many non-techies realise that turning a computer off
by its "apparent" power button on the front, isn't the same as removing the
power cord?

Most PC cases have power-buttons that are designed to look and feel a lot
like "real" power-isolating switches.