Sobig's Secondary Attack.

[Dr Halonfires LesGirl]

Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !

Read the full story
at http://psi.5544.net
NEW SECTION:-
Virus Alerts LIVE from Sophos !
ALSO
Also : Bush is Out of His Tree !!!
And much more.

[Karel]

Post by Dr Halonfires LesGirl
Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !
Read the full story
at http://psi.5544.net
NEW SECTION:-
Virus Alerts LIVE from Sophos !
ALSO
Also : Bush is Out of His Tree !!!
And much more.

PLOINK

[Karel]

On Fri, 22 Aug 2003 16:17:48 +0000 (UTC), "Dr Halonfires LesGirl"

Post by Dr Halonfires LesGirl
Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !
Read the full story
at http://psi.5544.net

It is true, it is like watching a thriller movie.
This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml
Jari

I better make a phonecall to Jari Litmanen to translate this one for me
:-)
What is the big deal now? Something new? I don't think so!

[n***@zilch.com]

Post by Karel

It is true, it is like watching a thriller movie.
This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml
Jari

I better make a phonecall to Jari Litmanen to translate this one for me
:-)

Save yourself the money:

http://www.f-secure.com/news/items/news_2003082200.shtml

Post by Karel
What is the big deal now? Something new?

Yep.

Post by Karel
I don't think so!

Non-believer!

:)


Art
http://www.epix.net/~artnpeg

[Karel]

Post by n***@zilch.com

Post by Karel

It is true, it is like watching a thriller movie.
This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml
Jari

I better make a phonecall to Jari Litmanen to translate this one for me
:-)

http://www.f-secure.com/news/items/news_2003082200.shtml

Post by Karel
What is the big deal now? Something new?

Yep.

Post by Karel
I don't think so!

Non-believer!

Non panicer would be more right:-)

Post by n***@zilch.com
The worm spreads itself via infected e-mail attachments in e-mails with

a spoofed sender address.
Nothing new to this.

Post by n***@zilch.com
All the infected computers are entering a second phase today, on Friday

the 22nd of August, 2003. These computers are >using atom clocks to
synchronize the activation to start exactly at the same time around the
world: at 19:00:00 UTC (12:00 in >San Francisco, 20:00 in London, 05:00
on Saturday in Sydney).

Nothing new to this except the atomclock part.
In my opinion you must run the atomclock program to be exactly on time,
is sobig.f able te execute it?
I have it on my PC :-)

Post by n***@zilch.com
On this moment, the worm starts to connect to machines found from an

encrypted list hidden in the virus body. The list >contains the address
of 20 computers located in USA, Canada and South Korea.

And these PC's must all be online at 19.00 UTC. What if they decide to
be online at 19.30 UTC?

Ok enough room for discussion. I am ever sceptic about warnings like
this. To me it seems to be a bit panic-ball.

[Karel]

Post by Karel

Post by n***@zilch.com
Non-believer!

Non panicer would be more right:-)

.

You skipped over the interesting part which gives a flavor of mystery
to the thing. Nobody knows what's going to happen at the appointed
time.

So the mystery part if the new thing? :-)

Do you have DSL service? Are you "infected"?

Yes, 1500k to be precise.
No I am not infected, at least there are no signs of any rash.

Post by Karel
And these PC's must all be online at 19.00 UTC. What if they decide to
be online at 19.30 UTC?

Maybe the "chosen ones" are on all the time.

So you must be part of the happy few that are both infected and chosen?
Why they don't choose me for once.
I even don't get one infected e-mail although my valid e-mail adress is
all over use-net.

Ok enough room for discussion. I am ever sceptic about warnings like

Post by Karel
this. To me it seems to be a bit panic-ball.

This one didn't strike me as panic-ball or silly hype. I found it at
least slightly interesting.

Interesting it is, with this I agree with you Art. But panic-ball it
remains in my opinion like all virus strikes.

[n***@zilch.com]

Post by Karel
So the mystery part if the new thing? :-)

It's the first time I've heard of this particular scenario,

Post by Karel
Do you have DSL service?

Yes.

Post by Karel
Are you "infected"?

Nope.

Post by Karel

Maybe the "chosen ones" are on all the time.

So you must be part of the happy few that are both infected and chosen?

Nope. Just interested.

Post by Karel
Interesting it is, with this I agree with you Art. But panic-ball it
remains in my opinion like all virus strikes.

Not all utterances from antivirus vendors are "panic-ball" :)


Art
http://www.epix.net/~artnpeg

[Dr Halonfires LesGirl]

Post by Karel

Post by Karel

Post by n***@zilch.com
Non-believer!

Non panicer would be more right:-)

.

You skipped over the interesting part which gives a flavor of
mystery to the thing. Nobody knows what's going to happen at the
appointed time.

So the mystery part if the new thing? :-)

Do you have DSL service? Are you "infected"?

Yes, 1500k to be precise.
No I am not infected, at least there are no signs of any rash.

Post by Karel
And these PC's must all be online at 19.00 UTC. What if they
decide to be online at 19.30 UTC?

Maybe the "chosen ones" are on all the time.

So you must be part of the happy few that are both infected and
chosen? Why they don't choose me for once.
I even don't get one infected e-mail although my valid e-mail adress
is all over use-net.

I can send you a copy of the 1 infected email I recieved today if you like.

Post by Karel

Ok enough room for discussion. I am ever sceptic about warnings

like

Post by Karel
this. To me it seems to be a bit panic-ball.

This one didn't strike me as panic-ball or silly hype. I found it at
least slightly interesting.

Interesting it is, with this I agree with you Art. But panic-ball it
remains in my opinion like all virus strikes.

When the Sobig worm connects to the server and distributes Sobig-G possibly,
in a mass-mailing campaign combined with a denial-of-service attack on M$
maybe, or whatever it does; then people like you will be asking people like
me why we didn't make a stronger case.

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Karel
In my opinion you must run the atomclock program to be exactly on
time, is sobig.f able te execute it?

Yes. That's my understanding.

That's not how I understood it... I think it's the *20 servers* that
have it -- so it starts at EXACTLY the same moment.

My favorite part of the F-Secure article is this paragraph:

"The advanced techniques used by the worm make it quite obvious it’s
not written by a typical teenage virus writer. The fact that previous
Sobig variants we’re used by spammers on a large scale adds an
element of financial gain. Who’s behind all this? “Looks like
organized crime to me”, comments Mikko Hypponen."
http://www.f-secure.com/news/items/news_2003082200.shtml

Organized crime? That's hilarious! Oh, how I wish Rob Rosenberger was
back from fighting the *real* war to see all this! He'd love it! ;-)

I haven't received the worm -- just the e-mail. Two-hundred-sixty, so
far. Increasing by the minute. ;-)

Wonder what it's supposed to do, today? Wouldn't it be funny if all
it did was just put up a graphic on the screen that says, "Psyche!
Serves ya right for not patching your pc and for executing unknown
attachments!"

(Flames via e-mail.)

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Because I *can* be.

iQA/AwUBP0Zz46RseRzHUwOaEQLr1gCgyKuVh7d86Itzbo8q5PIVAUpCuooAnjne
if5C8AQyYdcJ30AtF9VD/O3h
=qdUV
-----END PGP SIGNATURE-----

[Karel]

Post by Laura Fredericks
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Skip

Thanks for the moral support.

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Karel
Thanks for the moral support.

I have no sympathy for people who execute unknown attachments, or use
an e-mail program and/or newsreader that can render messages in
potentially-evil HTML, or don't patch their machines and get a virus.
Ditto for those who visit dubious websites, or download warez and get
a virus.

If you're driving your car without a spare tire and you get a flat --
whose fault is it?

If the weather forecaster says "rain today" and you don't take an
umbrella and get wet -- whose fault is it?

Etcetera... <yawn>

Blaming the software companies is a moot point. Computer systems and
programs aren't infallible, because they were written by HUMANS.
Humans aren't perfect and make mistakes.

Blaming the virus writers is a moot point. People are *going* to
exploit computer OS and programs. It's human nature. Whether for
damage, notoriety or plain ol' fun... They do it because they *can*.
;-)

Therefore, there's no one left to blame but...

Here's one of my favorite quotes:

"We are taught you must blame your father, your sisters, your
brothers, the school, the teachers -- but never blame yourself. It's
never your fault. But it's always your fault, because if you wanted
to change you're the one who has got to change."
- -Katharine Hepburn

(Sleep well, dear Katharine. We miss you.)

It's a big, tough world (wide web) out there. It's up to YOU to
protect yourself.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Because I *can* be.

iQA/AwUBP0aF26RseRzHUwOaEQKWmACg2KfwGn8FBZW0RngQ6KWeyNgmIbYAoNHq
2paK65ZAY6+TfL/qoRD/osNv
=BPMP
-----END PGP SIGNATURE-----

[Dr Halonfires LesGirl]

Post by Laura Fredericks
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Karel
Thanks for the moral support.

I have no sympathy for people who execute unknown attachments, or use
an e-mail program and/or newsreader that can render messages in
potentially-evil HTML, or don't patch their machines and get a virus.
Ditto for those who visit dubious websites, or download warez and get
a virus.
If you're driving your car without a spare tire and you get a flat --
whose fault is it?
If the weather forecaster says "rain today" and you don't take an
umbrella and get wet -- whose fault is it?
Etcetera... <yawn>
Blaming the software companies is a moot point. Computer systems and
programs aren't infallible, because they were written by HUMANS.
Humans aren't perfect and make mistakes.
Blaming the virus writers is a moot point. People are *going* to
exploit computer OS and programs. It's human nature. Whether for
damage, notoriety or plain ol' fun... They do it because they *can*.
;-)
Therefore, there's no one left to blame but...
"We are taught you must blame your father, your sisters, your
brothers, the school, the teachers -- but never blame yourself. It's
never your fault. But it's always your fault, because if you wanted
to change you're the one who has got to change."
- -Katharine Hepburn
(Sleep well, dear Katharine. We miss you.)
It's a big, tough world (wide web) out there. It's up to YOU to
protect yourself.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Because I *can* be.
iQA/AwUBP0aF26RseRzHUwOaEQKWmACg2KfwGn8FBZW0RngQ6KWeyNgmIbYAoNHq
2paK65ZAY6+TfL/qoRD/osNv
=BPMP
-----END PGP SIGNATURE-----
--
Laura Fredericks
PGP key ID - DH/DSS 2048/1024: 0xC753039A
http://www.queenofcyberspace.com/usenet-fact.jpg
Remove CLOTHES to reply.

I'd love to Laura; yours too.

Well said BTW; 'couldn't agree more.

[Bart Bailey]

Post by Karel
Ok enough room for discussion. I am ever sceptic about warnings like
this. To me it seems to be a bit panic-ball.

When I see those type warnings, I feel a twinge of hope that maybe this
time it will amount to something other than bullshit.
Not that I wish all the world's computers to crash
(might be interesting)
but that I would enjoy the surprise of having a bit of truth in the dire
warnings that always precede such non events.
Remember Y2K?

[n***@zilch.com]

Post by Bart Bailey

Post by Karel
Ok enough room for discussion. I am ever sceptic about warnings like
this. To me it seems to be a bit panic-ball.

When I see those type warnings, I feel a twinge of hope that maybe this
time it will amount to something other than bullshit.
Not that I wish all the world's computers to crash
(might be interesting)
but that I would enjoy the surprise of having a bit of truth in the dire
warnings that always precede such non events.
Remember Y2K?

Maybe you'd get some jollies out of this one then:

http://www.cs.wisc.edu/~plonka/netgear-sntp/


Art
http://www.epix.net/~artnpeg

[Julie Brandon]

Post by Bart Bailey
Remember Y2K?

Does it occur to you that not a lot happened because a lot of companies
took the warnings seriously and acted upon them?

I know personally that some companies, like IBM for instance, recognized,
and were dealing with, the issue from at least as far back as 1990 and very
probably earlier.

Similarly, today's SoBig-F panic has been about getting those 20 master
servers offline before things went into action. Last I heard, they had only
one left to deal with; if they succeeded, then the mass trojan download will not
be happening (at least for now, as unfortunately we gather that the virus
writer can update this list of servers, so it may turn into a cat and mouse
game.)

So, if those screaming out the warnings succeed in warning people and making
sure action is taken, and then because of that the sh*t doesn't hit the fan,
everyone then points fingers at them and says that they overreacted. It
seems to be that its an "any which way but lose" situation.

Ta-ra,

[Hurricane Andrew]

Post by Karel
And these PC's must all be online at 19.00 UTC. What if they decide to
be online at 19.30 UTC?

Maybe the "chosen ones" are on all the time.

Maybe the chosen ones, like the majority of modern PCs, can turn

themselves

on and off. As well being able to turn off when you ask Windows to
shutdown, many BIOSs give you the option of having a set time/date for the
computer to come on. Possibly the chosen machines have had their config
hacked to do this?

Possible, but I'd love to see a PC turn itself on without a power cord
attached :-)

---
Andrew

[Julie Brandon]

Post by Hurricane Andrew
Possible, but I'd love to see a PC turn itself on without a power cord
attached :-)

Hehehe.

To be fair though, how many non-techies realise that turning a computer off
by its "apparent" power button on the front, isn't the same as removing the
power cord?

Most PC cases have power-buttons that are designed to look and feel a lot
like "real" power-isolating switches.

[Tomi M]

Bart Bailey <***@nothere.net> wrote:
: In Message-ID:<***@4ax.com> posted on
: Fri, 22 Aug 2003 16:48:48 GMT, ***@zilch.com wrote:

F-secure reported 1950 UCT that they have not been able to
contact the machines spreading the new executable. 18 UCT
they mentioned that only one of the servers respond to
ping.

I just runned 2015 UCT a ping on all of the listed machines
and 9 of them answered to ping. So it seems that at least
some of the machines are now up. I have no idea if they are
already spreading the virus.

Tomi


: From the write up:
: ---begin---
: All the infected computers are entering a second phase today, on Friday
: the 22nd of August, 2003. These computers are using atom clocks to
: synchronize the activation to start exactly at the same time around the
: world: at 19:00:00 UTC (12:00 in San Francisco, 20:00 in London, 05:00
: on Saturday in Sydney).
: ---end---
: well, it's 1953 UTC and nothing has happened yet <g>
: --

: Bart

[Kimmo K. Kolari]

Check URL: http://www.f-secure.fi/news/items/news_2003082200.shtml

Post by Karel

On Fri, 22 Aug 2003 16:17:48 +0000 (UTC), "Dr Halonfires LesGirl"

Post by Dr Halonfires LesGirl
Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !
Read the full story
at http://psi.5544.net

It is true, it is like watching a thriller movie.
This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml
Jari

I better make a phonecall to Jari Litmanen to translate this one for me
:-)
What is the big deal now? Something new? I don't think so!

[Jari Lehtonen]

Post by Karel

On Fri, 22 Aug 2003 16:17:48 +0000 (UTC), "Dr Halonfires LesGirl"

Post by Dr Halonfires LesGirl
Sobig-F programmed to download malicious code at midnight GMT say
Sophos. -Only hours remain !
Read the full story
at http://psi.5544.net

It is true, it is like watching a thriller movie.
This is from F-Secure
http://www.f-secure.fi/news/uutiset/news_2003082200s.shtml
Jari

I better make a phonecall to Jari Litmanen to translate this one for me
:-)
What is the big deal now? Something new? I don't think so!

Sorry, I copied the Finnish address - sily me!
http://www.f-secure.com/news/items/news_2003082200.shtml

jari

[Lorene Ward]

This is what I was able to find out.
This info was from the F-Secure website.
at http://www.f-secure.com

F-Secure Virus Descriptions
Alphabetical Index

Radar Alert LEVEL 1
NAME:Sobig.FALIAS:W32/***@mm
THIS VIRUS IS RANKED AS LEVEL 1 ALERT
UNDER F-SECURE RADAR.
For more information, see:
http://www.F-Secure.com/products/radar/
A new variant of Sobig, known as Sobig.F was first found on August 19th,
2003 and it is spreading in the wild.
Update on August 24th
Sobig.F activates on Sunday the 24th of August at 19:00 UTC
Update on 19:00 UTC
Currently all master servers are down, nothing is likely to happen.
Update on 20:30 UTC
The situation remains the same.
Update on 22:00 UTC
Nothing happened - the attack failed again.
Update on August 22nd
Sobig.F activates on Friday the 22nd of August at 19:00 UTC. For
information on this, please see:
http://www.f-secure.com/news/items/news_2003082200.shtml
Update on 16:00 UTC
F-Secure can confirm that 18 of the 20 master servers are currently down
or unreachable.
Update on 17:00 UTC
F-Secure can confirm that 17 of the 20 master servers are currently
down. Apparently one of the machines was not disconnected by an ISP and
has been booted up by its owner.
We're working together with CERTs, FBI and Microsoft to stop the last
three.
Update on 18 UTC
F-Secure can confirm that ALL the master server machines are currently
down or unreachable. One of them seems to still respond to PING but not
to 8998 UDP.
We have one hour to go to see if this really is the case.
Update on 18:20 UTC
Unfortunately one server is up right now after all. And one might be
enough for the attack to start succesfully.
Update on 19:00 UTC
When deadline for the attack was passed, one machine was still
(somewhat) up. However, immediately after the deadline, this machine
(located in the USA) was totally swamped under network traffic.
We've tried connecting to it, just like the virus does. We do this from
three different sensors from three different machines in three different
countries. We haven't been able to connect to it once. If we can't
connect, neither can the viruses.
So the attack failed.
We'll keep monitoring until 22:00 UTC. If we're not able to connect
once, we can safely say that the attack was prevented.
Update on 19:50 UTC
Still not a single connection from any of our sensors to any of the
servers.
Update on 21:30 UTC
Situation is still the same. Things look good.
Update on 22:00 UTC
The official attack time on Friday has ended. All 20 machines were
inaccessible throughout the attack.
Now we are investigating random UDP traffic that has been seen in the
net, possibly relating to the worm.
Disinfection Instructions
Disinfection Tool
F-Secure provides the special tool to disinfect the Sobig.F worm. The
tool and disinfection instructions are available at:
http://www.f-secure.com/tools/f-sobig.zip
http://www.f-secure.com/tools/f-sobig.txt
http://www.f-secure.com/tools/f-sobig.exe
http://www.f-secure.com/tools/f-sobig.jar
You can also download them from our FTP server:
ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.zip
ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.txt
ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.exe
ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.jar
Detailed Description
Sobig sends massive amounts of mail. The sender information of these
mails is wrong and doesn't indicate the real infected user.

The attachment has a size of around 70KB and it's packed with TELock. It
has its own SMTP engine, apart from routines to query directly DNS
servers and make requests using the Network Time Protocol.
The worm will also attempt to fetch a URL from where to download
components when certain conditions are met. The condition, in this case,
is that the time which is obtained from one the NTP servers (which
addresses it has hard-coded inside its code) is Friday or Sunday
(regardless of the week) between 19:00 and 22:00 UTC time. The worm will
perform this test every hour.
When the condition meets, it will attempt to retrieve an URL from a
predefined list of 20 master hosts. The content of the URL will be
downloaded and executed on the infected machines.
The list of NTP servers, used to coordinate the download of the URL is:
(This is not the list of master servers)
200.68.60.246
62.119.40.98
150.254.183.15
132.181.12.13
193.79.237.14
131.188.3.222
131.188.3.220
193.5.216.14
193.67.79.202
133.100.11.8
193.204.114.232
138.96.64.10
chronos.cru.fr
212.242.86.186
128.233.3.101
142.3.100.2
200.19.119.69
137.92.140.80
129.132.2.21
Deactivation routine
The worm will stop spreading on 10th of September 2003. From this date
onwards the worm will exit immediately when executed.
Infection
It will install itself into:
%windir%\winppr32.exe
Proceeding then to add the following keys to the Windows Registry:
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrayX" =3D %windir%\winppr32.exe /sinc
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrayX" =3D %windir%\winppr32.exe /sinc
So it's started when Windows does.
Mail spreading
The worm usually arrives in e-mails with the following characteristics:
From:
The 'From:' field is filled with an address found from the infected
system. If no address is found, it will use "***@internet.com"
To:
The 'To:' field is filled with an address found from the infected
system.
Subject, any from the list:
Re: Thank you!
Thank you!
Your details
Re: Details
Re: Re: My details
Re: Approved
Re: Your application
Re: Wicked screensaver
Re: That movie
Body, it chooses one from the two following lines:
See the attached file for details
Please see the attached file for details.
Attachment names can be any from:
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
Sometimes the attachment is missing.
Also, the mail header always contains this string: "X-MailScanner: Found
to be clean". Do note that there's an anti-virus product which inserts
this header to emails.
Sobig history
The following table shows all the Sobig variants, with their expiration
dates and when they were first found in the wild. The "Detection" field
refers to when we first had databases which detected the corresponding
variant.
Variant Found Expires Detection
_____________________________________________________
Sobig.A January 9th NO 2003-01-09_04
Sobig.B May 18th May 31st 2003-05-19_03
Sobig.C May 31st June 8th 2003-06-01_01
Sobig.D June 18th July 2nd 2003-06-18_03
Sobig.E June 25th July 14th 2003-06-26_02
Sobig.F August 19th September 10th 2003-08-19_02
_____________________________________________________
Detection
F-Secure Anti-Virus detects the worm with:
[FSAV_Database_Version]
Version=3D2003-08-19_02
[Description: Ero Carrera, Veli-Jussi Kesti; 19th-24rd of August, 2003]
=A0
=A0
=A0=A0Virus Info
=A0
Latest ThreatsVirus DescriptionsHoax DescriptionsVirus Screen ShotsVirus
GlossaryAvoiding Computer WormsViruses in the Wild

=A0=A0=A0




Thanks,

Mrs Ward