Sobig.F worm could have originated on Usenet

The Sobig.F worm, which is estimated to have infected more than 100,000 computers and generated tens of millions of e-mails, could have begun life disguised as a pornographic picture in a posting to a handful of Usenet newsgroups.

Easynews, a Phoenix, Arizona, based provider of Usenet access, said it was served by the U.S. Federal Bureau of Investigation (FBI) with a subpoena relating to an account on its service that had been used to post the worm to Usenet. Easynews said it released customer records relating to the account to the FBI after receiving a copy of the subpoena on Friday morning.

Details of one posting made using the account were released by Easynews. It shows a posting on Monday August 18 at 19:46 GMT (3:46pm EDT) to six newsgroups: alt.binaries.amp, alt.binaries.boneless, alt.binaries.nl, alt.binaries.pictures.chimera, alt.binaries.pictures.erotica and alt.binaries.pictures.erotica.amateur.female.

The posting had the title "Nice, who has more of it? DSC-00465.jpeg" and contained a photo which, when clicked on, infected the browser's computer with the worm, said Easynews.

The company said the account in question appears to have been created with a stolen credit card for the sole purpose of uploading the virus to Usenet and was created a matter of minutes before the posting was made.

A search of Google's Usenet archive appears to back this up. It reveals a test posting carrying the same sender e-mail address listed in the worm posting -- misiko@dot.com -- was made to the alt.alt.test newsgroup nine minutes before the posting detailed by Easynews. That posting contained a short string of "1"s.

Realtime Communications, an Austin, Texas, Internet service provider which operates the dot.com domain, said the e-mail account listed in the posting is a fictitious one.

"The domain dot.com has only three e-mail addresses, and the address misiko@dot.com has never existed," a spokesman said by e-mail on Sunday. "It is trivial to put a fake e-mail address on a Usenet posting. In fact most people do this as a matter of habit, to prevent their e-mail address being captured by a spammer."

Two news reports Sunday, on the Web sites of Canada's National Post and Ottawa Citizen, said investigators had discovered the Usenet posting was made from a personal computer in British Columbia that had been infected by the virus.

Usenet is a vast distributed network made up of thousands of discussion groups, called newsgroups. It predates the World Wide Web as an Internet application and subjects up for discussion on Usenet are as varied as the millions of people that use it. Some bring together computer engineers working on modifications to the Linux operating system while others are concerned with, for example, Eastern European culture, apartments for rent, astronomy, classic cars, political discussion and pornography.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Martyn Williams

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?