World waits for Sober attack

Computers infected with the latest Sober worm will be capable of remotely downloading content from the writer of the worm at midnight tonight. 

The worm accounted for half of all virus infections during the past two months, and has spread relatively quickly because of good social engineering, in this case pretending to be an email from law enforcement agencies.

At midnight its payload activates and infected machines will start to trawl though a collection of websites looking for software to download.

However, security experts are not predicting widespread mayhem. "We don't think much will happen," said Mikko Hyppönen, chief research officer at security firm F-Secure.

"But if anything does happen, it will start at midnight in UK, 4pm in San Francisco, 7pm in New York, 2am in Finland and 9am in Tokyo."

Hyppönen published a list of those sites that may be hosting the software for downloading on the company's blog. 

Other security specialists are also sceptical about the prospects of a mass attack. "Of course nothing may happen at midnight," said Graham Cluley, senior technology consultant at Sophos.

"The writer could decide not to upload any information. If he knows he's being watched he may decide to lay low for a while."

NHTCU warns of Sober impersonators

It has bigger fish to fry  30 Nov 2005

Sober worm storms summer charts

Sober-N responsible for 44 per cent of all virus activity  01 Jun 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!