Virus Writers Join the War

The virus writers of the world have taken advantage of the onset of the war against Iraq. One example has seen an e-mail released that purports to offer a variety of war-themed attachments but instead contains a nasty self-replicating virus. The themes are highly varied and range from secret spy satellite pictures of Iraq to various screensavers that ridicule U.S. President George Bush.

Where did this particular virus come from and how virulent is it?

The infected e-mails actually contain a new worm virus called Ganda. The origins of this worm virus are thought to originate in Sweden. Right now anti-virus experts consider this menace to be “in the wild”. It travels using an e-mail as its host with a whole assortment of subject lines and text in the body. Unfortunately all versions have the same ultimate aim - to trick and deceive those who receive the e-mail into running the virus-ridden attachment.

While the worm virus at this time does not have a “critical risk status” for home and commercial Internet users it does indicate just how far some virus writers are prepared to go to get attention.

How does this virus encourage people to participate in its spread?

Once more this latest virus scare reveals the worrying trend of social engineering by virus authors, that is, the practice of some particularly high profile and topical event, subject or person and then using it as a hook to lure computer users into launching a virus.

As seen with the most recent Catherine Zeta-Jones worm, the most widespread deceptions involve offering candid shots of popular celebrities. One commentator describes this as the "go for the loins" approach, but in a time of war these practices can become more sinister.

With the war in Iraq likely to be the most prominent international hostility since the widespread adoption of e-mail in homes and business worldwide, social engineering is seen as a sure way to play an even greater part in the spread and dissemination of similar viruses.

Will this conflict generate more or less of the same?

There is sure to be a lot more viruses launched in e-mails related to and using the war in Iraq as a theme. This will almost certainly not be the last batch. These virus alchemists will continue to play upon people's curiosity for information about the war. This particular type of virus writer should not overawe us – they are usually not all that clever.

These types of Virus writers will use just about any occasion they can think of to act on computer users. It doesn’t matter how sick or disturbed the context or content. Examples such as attack on the World Trade Centre or the war with Iraq are prime time. This particular breed of low-life are, at the very best, simply attention seekers and will use any method they can that gains them public attention

The problem is, as copy cats, once one group are presented with a successful method of getting people to launch viruses, another group will adopt it for themselves.

How does this particular virus actually work?

Once activated Ganda will behave very much like any of the other self-propagating worms we have seen in the past. It will gain access to the addresses in your e-mail address book and then on forward itself to all of those contact addresses it has found.

Typically, it will try to infect a computers Microsoft Outlook e-mail address book. It also scans the computer for any Anti-virus programs such as McAfee, Norton or Sophos. Once found, it will then shut them down making them ineffectual in protecting the system against the imminent attack.

How do we avoid being deceived by these types of viruses?

The only way this type of virus can be avoided is for everybody to treat e-mails purporting to be about the war in Iraq with suspicion. However more importantly have a mind set that considers all e-mail as a dangerous and a potential virus unless source can be authenticated or the recipient personally knows the source. As always keep your anti-virus software updated.

Arthur Hissey
Computer Research & Technology
www.crt.net.au