Bugbear e-mail Worm Spreading at an Alarming Rate; F-Secure Raises Alert to Highest Level, as Bugbear Becomes The Most Widespread Virus Currently in Circulation.

Business/Technology Editors

HELSINKI, Finland--(BUSINESS WIRE)--Oct. 2, 2002

The Bugbear e-mail worm (also known as Tanatos), first seen on Monday, September 30, has been located in dozens of countries worldwide and continues to spread at an increasing rate. Current statistics show that Bugbear/Tanatos has passed Klez as the most common virus currently in the world.

Bugbear is a Windows mass mailer, spreading itself in infected e-mail attachments, sometimes executing the attachment automatically. It also tries to spread through open Windows fileshares. A side effect of this is that the worm sometimes prints massive amounts of nonsense text on network printers.

The worm also attempts to terminate the processes of various antivirus and firewall programs. Once a machine is infected, it can be remotely controlled via a graphical backdoor, allowing the hacker to steal and delete information from affected computers.

VIRUS OPERATION

The worm can pick up old e-mail messages from an infected system and send them to random e-mail addresses. This means that private e-mails will be disclosed to third parties. "Forwarding old e-mails is actually a social engineering trick," comments Mikko Hypponen, manager of anti-virus research at F-Secure. "When people receive such e-mails, they will be baffled by the contents. In many cases they will click on the file attachment just to figure out what the strange e-mail is all about - thereby becoming infected."

Some e-mails sent by Bugbear will use the IFRAME vulnerability. This means that on an unpatched Windows system, the worm attachment will execute automatically as soon as it is previewed or read. In some cases the worm fakes the e-mail address of the sender, thus making it look as if an innocent third party sent the worm. This creates further confusion and makes it difficult to warn the infected parties of the problem.

Once one machine gets infected via e-mail, the worm spreads effectively within corporate LANs. It will enumerate all network shares and try to copy itself to them. On Windows machines with hard drives shared for several users, the worm attempts to copy itself to the Startup folder, activating when the machine is rebooted.

The worm tries to copy itself to all types of shared network resources - including printers. Printers will not and cannot get infected by Bugbear, but they will attempt to print out the binary code of the worm, resulting in dozens or hundreds of pages of garbage.

The Bugbear worm tries to terminate various processes in the memory of an infected computer. This includes processes used by most of the popular antivirus and personal firewall products, including the outdated F-Secure Anti-Virus v4.x series. However, the worm does not affect the current F-Secure Anti-Virus v5.x series. In any case, the worm can only attack security programs if it executes, and up-to-date anti-virus programs will prevent it from executing. "As this worm is already widespread, there must now be thousands and thousands of computers in the Internet without any antivirus or firewall protection, because Bugbear has removed them," commented Hypponen.

The worm will install a backdoor to all infected systems. This backdoor can be exploited by the virus writer or by hackers, allowing them to connect to infected machines using a web browser. The worm will show a web user interface through which the attacker can browse local files or execute programs.

"We haven't seen such an advanced backdoor in a worm before," said Hypponen. "Fortunately, it is not easy for script kiddies to enable this functionality.

"It was such a nice and quiet year virus-wise, up until the middle of September," continued Hypponen. "After that we have had many large outbreaks, including the Slapper and Devnull Linux worms, and the Opaserv and Bugbear Windows worms."

The year 2001 is generally considered to have been the worst virus year ever. "During 2002, the Klez virus has been the most common virus for months and months. As Bugbear is quite similar to Klez in many ways, I am afraid Bugbear will still be widespread in 2003," Hypponen said.

A detailed technical description of the worm as well as screenshots are available in the Global Bugbear Information Center at http://www.F-Secure.com/bugbear/ .

F-Secure Anti-Virus 5.40 can detect, stop and disinfect the Bugbear worm, even if the system is already infected with the worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com

About F-Secure Corporation

F-Secure Corporation is a leading provider of centrally managed security for today's mobile, wireless enterprise. The company offers a full range of award-winning, integrated anti-virus, file encryption, distributed firewall and VPN solutions for workstations, servers, gateways and mobile devices. F-Secure products are uniquely suited for delivery of Security as a Service, which provides invisible, reliable, always-on, and up-to-date security for the most widely distributed user base. Whether provided by corporate IT or delivered by service providers, F-Secure solutions extend policy-based security and instant alerts to all devices where information is created, stored or accessed. Founded in 1988, F-Secure Corporation is listed on the Helsinki Exchanges (HEX: FSC). The company is headquartered in Helsinki, Finland with North American head office in San Jose, California, as well as offices worldwide.