Spread of Kournikova Virus Highlights Security Lapses

by Jennifer DiSabatino

March 8, 2001 —

Security software vendors and other experts are warning users of the dire consequences of viruses, such as the worm disguised as a photo of Russian tennis star Anna Kournikova that was launched last week.

Servers across corporate America were bombarded with the Visual Basic Script (VBS) worm built from a crude tool kit. That the worm spread as swiftly as it did shows that companies have a long way to go to improve lax security in their infrastructure and among their users, said observers.

"I didn't see anything new about this one. People should have had filters in place to prevent this," said Mark Amos, manager of information security at Owens Corning in Toledo, Ohio.

JUST THE FACTS

Watch for Traffic

You're bound to get hit once in a while, but there are a few things you can do to minimize the damage:

Block or disallow suspect extensions, like .exe and .vbs

Put up layered virus detection and filtration devices inside and outside the firewall.

Tell your users whenever you see a new virus start to come across, even if you think you're blocking it.

The worm, which did no damage, was allegedly written by a 20-year-old Dutch man who turned himself in to police. In a statement to authorities, the suspect said he "made a virus to prove how simple it was to make [one] and how vulnerable computers are."

A Patch Does Exist

Once the attachment was opened, the worm worked its way through the address books of Microsoft Outlook users. Yet, eight months ago, Microsoft Corp. put out a patch for its Outlook e-mail software in response to similar problems with the "I Love You" virus. That patch would have prevented users from being infected with the Kournikova worm, said Vincent Gullotto, the director of McAfee.com Corp.'s McAfee Anti-Virus Emergency Response Team laboratory in Beaverton, Ore.

While those hardest hit aren't talking about the virus and its damage to their corporate systems, a few security managers have shared their experiences with the Kournikova worm, or VBS/SST.

Paul L. Schmehl, supervisor of support services at the University of Texas at Dallas, said constant education of his staffers has led them to a point where he trusts them to recognize the potential threat in unsolicited attachments.

"Our experience has shown that our users do use sound judgment regarding attachments," he said. "However, the onslaught of viruses that use stealth, encryption, multiple attachment file names, subject lines and body text makes it more hassle than it's worth to keep our users informed of the details of every virus. So we now bounce them at the gateway mail server, and they never enter our environment."

Among other things, Schmehl filters .vbs files. Amos said he deploys similar multiple lines of defense at Owens Corning, and that prevented infection this time.

Owens Corning uses several layers of security that keep end users from even seeing an attachment, Amos said. The company uses a filter service outside the firewall, antivirus software at the firewall, filters internally between servers and on the antivirus software on the desktops. Users, with some exceptions, can't receive attachments, said Amos. "We didn't have any problem," he said.

Blocking suspect attachments is no silver bullet either, said Matthew Pemble, a consultant at the Preston Technology Management Centre in England, since files can be saved with any extension.

"This is not to say that blocking by extension is bad -- it is a massive damage limiter -- just that it is not enough," Pemble said. "Scan everything at the gateway, scan everything at the desktop [preferably using different tools.] And then expect to get hit once in a while, anyway."

Computerworld