Networks especially vulnerable to new breed of sophisticated computer bugs

posted onJuly 16, 2001

by hitbsecnews

Its ironic. Even as hackers and crackers from around the world were converging Friday in Las Vegas for the annual DefCon conference, two viruses written by some of the programming underworld's best are spreading like wildfire in the cities they're leaving behind. Unlike most viruses, these two don't require you to receive an e-mail, double-click on a file attachment or even open an e-mail program in order to become infected.

Instead, they travel using a combination of e-mail and corporate and home networks, infecting computer after computer without the owners even knowing they've been hit. Trend Micro, maker of PC-cillin antivirus software, says that at least 90,000 computers have been infected by some variant of the Magistr.A or Funlove.4099 viruses in the last 30 days...

Detroit Free Press

SECTION: BUSINESS AND FINANCIAL NEWS

LENGTH: 733 words

HEADLINE: Networks especially vulnerable to new breed of sophisticated computer bugs

BYLINE: By Heather Newman

BODY:

Magistr.A is particularly nasty: It can erase your hard drive and overwrite the BIOS memory that stores crucial information your computer uses to boot up when you turn it on.

Funlove.4099 adds itself to program files on your hard drive and can cause them to stop working. If you're in an office where access to some files is limited by password protection, it can also make those files open to anyone who wants to look at them.

What's important about these two viruses is that they're network-aware, so they can spread faster than by just using e-mail. Here's how they work:

Someone receives an e-mail with a file attachment. Both viruses generate random subject lines and e-mail messages, so there is no pattern as to what the e-mail looks like. When the person double-clicks on the attachment, the virus begins to run.

It records itself on the hard drive and proceeds with the usual shenanigans: infecting files and sending itself to everyone in the person's e-mail address books and Sent Mail files (typically only if the person uses Outlook, Outlook Express or Netscape Communicator).

But here's where it gets hairy: Both viruses also know to look on your computer to see whether the person has access to a network, either at home or at work. If so, the viruses search to find other computers that the person has access to, and infect ALL those computers, whether those other people are logged on to their machines or not.

The viruses run on those machines the next time they boot up, and the process begins again.

In a company with hundreds of computers, people can infect and reinfect each other dozens of times a second without anyone knowing what's happening.

"Someone sitting on the other side of the building can be infected because I clicked on a virus," said Joe Hartmann, director of North American antivirus research for Trend Micro.

Trend Micro lists them as the top two viruses found "in the wild" in the last 30 days. Symantec's Anti-Virus Research Center lists a Magistr.A variant as one of its top threats.

Hartmann said Friday that polymorphic viruses like Magistr.A, which change themselves each time they infect a new computer, were the top security threat under discussion during the opening day of the DefCon convention.

Here's how to protect yourself:

Keep your antivirus program running at all times and set to scan every program file that's written onto your hard drive.

Make sure its virus definition files _ which tell it what to look for _ have been updated in the last month. Those definition files are typically available for free on the antivirus program maker's Web site.

If you don't have an antivirus program, visit a Web-based scanning site like Trend Micro's HouseCall (http://housecall.trendmicro.com) or Symantec's free online virus check (www.symantec.com/avcenter; scroll down to "Free online virus check").

Check to see whether any of your drives are easily visible on a network by double-clicking on My Computer, then looking carefully at the hard drives and folders you find there to see whether any have a blue hand under them.

If they do and you're on a network at your company, ask the tech support folks there to help you make them password-protected. If you shared the drives so you could see them on your own network, right-click on them and choose "Sharing" from the menu that pops up to see what the password settings are.

Finally, don't double-click on a file you get via e-mail from someone you don't know.

Visit the Freep, the World Wide Web site of the Detroit Free Press, at http://www.freep.com.