NIPC feels SirCam Worm's Bite
An e-mail worm sweeping the Internet has infected at least one computer in the FBI's National Infrastructure
Protection Center.
Messages containing the SirCam worm were sent from an FBI.gov account of a NIPC special agent this morning to
several private-sector security professionals, including the operators of the Safemode defacement archive.
Like other e-mails automatically generated by the SirCam worm, the messages included attached files and a body
that read, "Hi! How are you? I send you this file in order to have your advice. See you later. Thanks." The worm also
has a Spanish-language variant.
A file attached to one of the infected e-mails obtained by Newsbytes included text marked "Official Use Only," which
contained an analysis of another Internet worm named Leave. A second message included an attachment in
Microsoft Word format that discussed countermeasures against distributed denial of service attacks.
Phone calls to the FBI agent were not returned. However, a spokesperson for NIPC confirmed the release of the
infected e-mail and said the organization would provide more information about the incident later today.
NIPC, a division of the FBI, investigates and responds to technology-based threats against U.S. critical
infrastructures.
Rob Rosenberger, a virus expert who has lectured to the Department of Defense and other government agencies
about information warfare, told Newsbytes that the presence of a computer virus infection within the FBI is not
surprising.
"I love the irony, but this isn't the first time that virus experts have been tripped up in the process of doing virus
analysis," said Rosenberger.
Besides clogging e-mail inboxes and mail servers with its sometimes bulky attachments, SirCam presents a
potential confidentiality breech. Once it has infected a PC, the worm spreads by grabbing a copy of a document
from the user's computer and adding its malicious code to the file. The infected file is then attached to new outgoing
messages with a double-extension filename such as .doc.exe.
The infected documents are distributed from the SirCam victim's computer to e-mail addresses found in the user's
Windows address book or in temporary Internet files. The worm can also spread using open network shares on a
PC.
According to Kaspersky Labs, an anti-virus research and software firm, since its discovery on June 18 SirCam has
established itself as the most widespread e-mail worm in computing history.
Kaspersky and other software vendors provide detection for SirCam in their anti-virus scanners, as well as special
tools to remove the worm from infected PCs.
The Department of Defense confirmed Monday that it has blocked outside access to many of its Web servers as a
precautionary measure against the Code Red Worm, a self-propagating program that infects Web servers running
Microsoft's Internet Information Server (IIS).
The FBI's NIPC is online at http://www.nipc.gov .
More information on SirCam is available at http://www.viruslist.com/eng/viruslist.asp?idB25&key
