Sober.Q Virus Held in Check at SafetySend - Published: May 18, 2005

SafetySend clients were not compromised by the latest penetration begun on Friday the 13th. The virus continued to send infected hate messages worldwide over the weekend. Sober.Q spread hate messages in German and English while infecting PCs. Although millions of people were infected and damaged, our web servers did what they were designed to do; stop viruses, spam and protect confidential information.

Many security companies say that they received hundreds of thousands of e-mails generated by Sober.Q in its first day. This latest variant of Sober was uploaded to computers that were most likely infected by previous variants of Sober, meaning the virus authors may have had remote control over thousands of PCs.

Safety Send security group estimates over 100,000 penetration attempts. The security group reconfigured proprietary code and encryption algorithms to prevent the loss of Protected Health and Financial Information. As a result, no users of Safety Send received the Sober,Q via Safety Send and no files were lost or penetrated. The system was held in “safe mode” for approximately two hours on May 16. The resource requirements of this attack did slow access to email via the web, Outlook users suffered no interruption in service.

MX Logic's threat center categorized it as a threat of high severity and reported seeing more than 125,000 instances of the Sober.Q worm. According to internet security specialist SurfControl, they reported seeing over 1,000 spam e-mails within hours of the initial outbreak. The company indicates this level is about 40 times the usual number.

Within the last week, antivirus companies were issuing warnings that the previous and less aggressive Sober variant had unexpectedly modified its behavior and stopped proliferating. Antivirus companies warned that the previous Sober variant, disguised as tickets to the Soccer World Cup in 2006, had gone into a quiet period. The momentary calm in activity seemed to have been planned by the virus writers to lay groundwork for this latest attack. The latest variant's purpose seemed to be to open secure networks, infect user PCs and distribute hate mail.

SafetySend, Inc. provides secure communication technology for compliance with HIPAA (Health Insurance Portability and Accountability Act) and GLB (Gramm-Leach-Bliley) to cover regulatory requirements for electronic communication and data transfer.

Author:  

Email:    

Topic:    

Content:

Related Articles

• Unique PIDC Location Code is Critical for Guaranteeing Food Chain Security
  15 May 2005



• TechBiz Connection Sponsors Cyber Security Summit
  12 May 2005



• Vanguard Integrity Professionals Simplifies The Delivery of Security Software For The Mainframe
  10 May 2005



• Symantec Mobile Security 4.0 for Symbian Protects Smartphones from Viruses, Hackers, and Other Malicious Threats
  9 May 2005



• European, U.S. On-line Banking Security Measures May Be Insufficient
  9 May 2005



• IntraSource Expands Managed Security Service Partnership With ProtectPoint Security, Inc. enhances Security Suite
  1 May 2005



• Pentacom Canada Offers Special Pricing on Security Solutions for the Retail Industry
  28 April 2005



• CyberShield Networks Selected to Present at U.S. Department of Homeland Security ESTF Forum
  25 April 2005



• Interlink Announces Free LucidLink Wireless Security Software
  22 April 2005



• Network Engines Announces Channel Program for NS Series Security Appliances
  21 April 2005