January 27, 2004 (Computerworld) -- The SCO Group Inc. said today that it's experiencing a distributed denial-of-service (DDOS) attack apparently related to the Mydoom worm that first appeared yesterday.
SCO said it's offering a reward of up to $250,000 "for information leading to the arrest and conviction of the individual or individuals responsible for creating the Mydoom virus."
In a statement released late today, the company said it has been the target of several such DDOS attacks during the past 10 months. During that period, the company has been embroiled in legal action against IBM over intellectual property rights related to its ownership of System V Unix code.
But the one now under way "is different and much more troubling, since it harms not just our company, but also damages the systems and productivity of a large number of other companies and organizations around the world," said SCO CEO Darl McBride in the statement. "The perpetrator of this virus is attacking SCO. ...
"We do not know the origins or reasons for this attack, although we have our suspicions," said McBride, who didn't elaborate on what those suspicions are. "This is criminal activity and it must be stopped."
The company also said it is working with U.S. law enforcement authorities, including the U.S. Secret Service and the FBI, to try to determine who might be involved in the attack.
The Mydoom worm, also known as Novarg and Mimail.R, is a mass-mailing worm that arrives via e-mail as an attachment with one of several possible file extensions, including .bat, .cmd, .exe, .pif, .scr or .zip. When a user opens the attachment, his computer becomes infected. The worm is apparently designed to attack the company's Web site, www.sco.com, beginning on Feb. 1.
Experts have said that the Mydoom worm is spreading faster than last year's Sobig.F, which topped the charts as the most widespread e-mail worm of 2003.
Both Network Associates Inc. and Symantec Corp. said that when the attached file is executed, the worm scans the user's system for e-mail addresses and forwards itself to those addresses. If the victim has a copy of the Kazaa file-sharing application installed, it will also drop several files in the shared-files folder in an attempt to spread that way.
According to Symantec, the worm also installs a "key logger" that can capture anything that is entered, including passwords and credit card numbers, and will start sending requests for data to SCO's Web site. If enough requests are sent, the SCO site could be forced off-line.
"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..."
Read more...
"It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...."
Read more... Read more Security posts or See all Blogs
Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft.
Why SaaS is Vital to Email and Web Security
Download this webcast, free, compilments of Webroot Software
Go to the webcast
Managing Mobile Data with Endpoint Security for Laptops
Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error.
Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network.
Download this executive briefing
Top 10 Reasons to Upgrade
Get this white paper now! (Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
XenServer FREE trial
Citrix XenServer is the simplest and most effective way to virtualize and provision servers. XenServer combines comprehensive server virtualization capabilities with unparalleled scalability, performance, economics, and ease-of-use. Based on the open source Xen hypervisor, XenServer delivers fast performance, easy management, and advanced features such as live migration.
Try Fluke Networks'
EtherScope Analyzer on your network FREE
Quickly solve the wide range of problems you encounter - 10, 100 and Gigabit, twisted pair and optical fiber, LAN or wireless LAN. The EtherScope Analyzer combines the essential tools you need to monitor network traffic and switch interfaces, discover devices, networks, VLANs, access points, mobile clients and more. See the power of this portable network analyzer on your network.
*Terms and conditions: Evaluation units are available only for a limited time and will be scheduled on a first-come first-served basis. Not available in all geographies. Limited quantities available; customers requesting evaluation units may be waitlisted for the next available unit. It will be at the discretion of Fluke Networks to accept or decline requests for this free evaluation.