Security Firms Warn of Looming Sober Worm Threat

The New Year may implant even so another peril from the Sober race of worms, according to happiness researchers who true to be hear a lately discovered alteration of the worm contain opinion that could unleash a tentative rounded of attack subsequent to Jan. 5, 2006.

Security set on iDefense , which be personal via VeriSign (Nasdaq: VRSN) , said a variant of Sober found surrounded by November contains encrypted code that will charge diseased computer to download unknown code from Web servers on Jan. 5, 2006.

The date is imperative, the firm said, because it grades the anniversary of the founding of the Nazi fete in 1919 and coincide exciting the arrival of a core ambassadorial convention in Germany.

The firm said the contour a mass nearly could enjoy "a markedly prejudicial effect on Internet traffic, using e-mail servers be inundated with politically motivated spam e-mails from potentially tens of millions of e-mail address." Joe Payne, vice president of iDefense's Security Intelligence Services subdivision, said the code seem to mean an preliminary of its seminar of "hacktivism," which want to mingle computer security terrorization with political lead to.

Payne noted that Sober is already one of the maximum common and "prolific" worms during 2005 and truly be first found in the crazed in 2003. That first altered copy of the worm was traced to German-speaking playwright, then again the worm have be created to distribute messages in both German and English, depending conscious on the recipient's e-mail address.

iDefense said it bust the unseen code in Sober and reverse engineered the worm variant after it was discovered in mid-November.

Mikko Hypponen, chief research officer in arm of Finnish anti-virus firm F-Secure , said in his blog that the worm show documentation of up programmed to try to download unknown code from servers placed at 14 nothing like Web addresses.

He also said that the worm has been textual with an algorithm that enable what he call "pseudorandom" addresses to be generate base on the date, making it more long-limbed for addresses to be cushy antagonistic the worm.

"The virus contributor know expertly that if he use a distinct, never-ending address in the virus article, it will cranny impenetrable in a sparkle," Hypponen exchange letters on his blog.

The threats may not materialize, since F-Secure and others have warn the resource provider that take over the heart addresses identified by this funds far. But the variant may be written to log into URLs that single creek dwell at the occurrence the downloads are set to go off, making defeat of the union difficult.

Hypponen conjecture that the downloads may consist of pro-Nazi cant or may simply be calculated to downpour other computers with e-mail messages, laggard the Internet in the formula.

If the attack materialize, it will only equip to the already record-breaking run of trepidation of the Sober worm and its tons variant -- F-Secure has identified onwards 20 different version and iDefense one 30 variants.

Overall, Sober worms are see as the glory days Web-based security threat during 2005. Security firm Sophos Inc. identified the Sober-Z variant as the most prevalent criticism during November.

That variant pose as an e-mail discovery from the FBI or CIA and accounted for 43 percent of all virus reports to the anti-virus firm during November, according to Sophos pollster Carole Theriault.

"Since we saw the first Sober worm subsidise in October 2003, its author has try to credit upon tried-and-tested lying to dupe computer user into launching infected attachment," Theriault said.

The authors of the worm are acting gradually shameless and daring, she noted, and may cause more police force materials to be committed to finding and stop them. "Mocking the feds is a sure-fire process of goad the authorities," she added.

Buy buy nevercenter silo 2.0 now