A Look Into The Viruses That Caused Havoc In 2003
by Berislav Kucan - Tuesday, 23 December 2003.
Graham Cluley: The biggest viruses were Sobig-F, Blaster and Nachi. Sobig-F showed that viruses could be a spam problem, with the sheer amount of emails it generated. Some companies received hundreds of thousands of copies of Sobig-F every day. Blaster and Nachi showed that many computers were not being properly secured against the latest vulnerabilities, and that viruses could spread very fast via a route which was not email. Other worms, such as Mimail, launched internet attacks on anti-spam organizations showing the spammers and virus writers were working closer together.

David Perry: Clearly, the rise of network viruses, starting with SLAMMER and climaxing with MS-Blast. The slammer worm was propagated on Super Bowl Weekend, which caught many American computer users unawares. It leveraged network protocols to spread from sql server to sql server. It was, however, limited to only infecting servers of that type. Slammer was so successful that it managed to obscure an entire country (South Korea) from the Internet--an unprecedented event in the history of malicious code. Blaster, on the other hand infected all copies of Microsoft NT, XP and 2000. This raised the potential victim count from several hundred thousand to hundreds of millions, worldwide. Also known as Nachia, this network virus went through a variety of versions and has had the lasting effect of disabling use of MS-Exchange from most ISP's (exchange connect from client to server on port 135--which was one of the primary ports used by the worm. I use the terms virus and worm interchangeably because worms are a special subset of viruses, hence all worms are viruses.

All network worms share the ability to infect a machine with no interaction from the user. This makes them both more prolific and more secretive. A user has no visual clue whatsoever that he or she is infected with a network worm. This is the most pernicious of their various traits. On an entirely different front--there has been a great deal of speculation about the connection between spam and viruses. A particular email worm (SOBIG) dropped a component that could conceivably be used by spammers to spread their annoying email messages anonymously.

Fernando de la Cuadra: The year began with SQLSlammer, a really fast infector. It only collapses MS SQL Server, but the speed when infecting servers was really incredible. It was a very important milestone for AV manufacturers because most of them cannot detect the code with their obsolete technologies. The Blaster virus attacked in August, once again using system vulnerability, and having fast propagation. Both viruses are, from my point of view, the biggest infectors appeared in 2003, but there is a really important infector in 2003, that appeared a long time ago: Klez.I virus. Since its discovery, it is always on the top virus lists.

Denis Zenkin: Undoubtedly the major deplorable surprise on the virus scene this year was high proliferation of the "flash"-type network worms: Slammer and Lovesan. This implies the real start of a new era of malware creation and protection: traditional anti-virus tools are no longer enough to protect a workplace against worms, but they should be definitely strengthened with firewalls to ensure maximum security. Another disturbing trend is of course the situation with security patches. The speed they are released and the way they are distributed is not sufficient.

Mikko H. Hypponen:From my perspective, these were the top five issues:
  • Slammer: single largest attack against the internet ever
  • Sobig.F: single largest email worm ever
  • Microsoft buying RAV and entering the AV business
  • New York blackout
  • Spammers starting to use viruses
Nick Galea: E-mail viruses were again at the forefront of IT news this year - particularly with viruses like Mimail and its variants, which attempted to steal confidential information from the compromised computers. Other special occurrences include SoBig, its variants and Bugbear.B, which spoofed the sender email address to make the infected email look legitimate and the Blaster worm, which exploited a known Windows vulnerability in order to disseminate.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th