SECURITY
SCO falls to MyDoom.A worm
02-02-2004
by
The MyDoom.A worm, released just a week ago, is continuing to wreak havoc on the Web, taking down the Web site of Unix software vendor SCO on Sunday.
The worm is designed to initiate a denial of service attack on the SCO Web site beginning on February 1. According to reports, the attack began on Saturday, earlier than expected, although this may have been due to infected machines in different time zones and incorrectly set computer clocks. The SCO Web site ceased to be available on Sunday and it is believed that the company simple shut down its Web server. The site was still unavailable at the time of writing. The worm is designed to cease the attack on February 12.
A surprisingly small number of machines are needed to launch a successful denial of service attack. "Unfortunately, it's not that many machines that are needed," said Conor Flynn, technical director at Rits Information Security Consulting. "It's simply a question of bandwidth, whether the infected machines can command a greater amount of bandwidth than the Web site under attack. With the arrival of home broadband connections, most of which have upload speeds of around 256Kbps, only a couple of hundred machines may be needed to launch an attack."
The attack on SCO may be due its recent lawsuit against Linux vendors, which claimed that some of its code had been used in the open source operating system. SCO's move sparked a huge degree of anger in the open source community.
SCO has offered a reward of USD250,000 to anyone who can provide information on the authors of the virus. A similar initiative has been undertaken by Microsoft, which is the target of a second variant of the worm, known as MyDoom.B. The company said that it would pay a reward of USD250,000 to anybody who provided information resulting in the arrest and conviction of those responsible for unleashing the worm. The new variant of the worm is quite similar to the original. It is designed to initiate an attack against the company's Web site on Tuesday, along with also attacking the SCO Web site from February 1.
According to Flynn, Microsoft may be in a better position to deal with an attack, although little can be done to prevent it. "Microsoft have much more experience in dealing with this kind of thing. Their Web presence is distributed around several locations, they have multiple DNS entries and they have more bandwidth available," he said.
However, despite the publicity surrounding the two variants of the worm, it may take some time for the effects to abate. "You have to remember that the worm blocks access to anti-virus and security sites, which means people may have difficulty removing it," said Flynn. He predicted that the success of MyDoom may lead to the emergence of more new worms and warned that incidents such as this will continue until users change their habits regarding PC security.
Creating successful email surveys: Denise Cox of email specialist Newsweaver argues that you can tap into your readers' likes or dislikes by surveying them.
