December has come and gone and another interesting but somewhat quieter month on the malware front at least, it has been.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter for December.
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 3 years, Malware Bayesian Filter 2 years.
In total I captured 1822 samples during December, which have been catalogued as 61 distinct families and variants. In comparison during November 2005 I captured 2489 samples which were catalogued as 59 distinct families/variants. As you can see December was well below the average malware haul for 2005. As a guide, an average month’s captures for 2005 was around 3,000 samples.
During December I captured and submitted 3 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].
The low haul in December is partly due to an apparent drop-off in new samples being spread via SMB [Windows shares], the relatively low impact of the latest Sober strains [via E-mail], and finally but not least; I moved ISP due to my old one starting to block SMB and other ports used by malware to spread from machine to machine.
During December I reported 40 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] held onto pole position during December. Tenga accounted for a whopping 63 percent of all captured files during December!
Surprisingly the Mytobs put in a poor show during December only managing to retain one place in the top 10. The Sober family managed to remain in the top 10 during December.
It seems that the share-crawling worms and bots took back a number of slots during December; in fact they took six, leaving just four for the e-mail based worms and bots that have dominated many of the 2005 monthly top 10 charts.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] this month has seen Mytob.c knocked off pole position by none other than Zafi.d, which accounts for over 29 percent of reports. Mytob.c has had to make do with second place in December; accounting for seventeen percent of reports. The rest of the chart is made up of Lovgate.w in third, Sober.y [aka Sober.Z] in fourth, another Zafi [b] in fifth place followed by a pair of Netsky variants [q and b] in sixth and seventh place. The last three places see three more Mytob variants [ t, u and q], just managing to keep a place in the top 10. These trailing Mytobs account for a mere 6 percent of the top 10; this is a long fall from grace for a malware family that has at times swamped the top 10. Doombot [b and d] have both fallen out of the top 10.
In the SOPHOS chart we see a different pattern, with Sober-Z sitting in pole position. Netsky.p has to make do with third place this month; its second place spot from November has been stolen by Zafi.b. 6 Mytob variants [ EX, FO,BE, GH, C, and FM] appear in the top 10. Just like in the data from Kaspersky we have the Zafi.D variant too.
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by Septembers leader, Tenga accounting for over 63 percent of all samples caught. Mytob could only manage a measly 4th place accounting for a mere 6 percent of captured samples.
The Sdbot family has regained some of its share over the last month; jumping from 2.1 percent in November to over 8 percent of all captured samples in December. Interestingly Zafi only just managed to scrape in to the top 10 this month; accounting for only 1.2 percent of all captured samples.
If you wish to see the current top 10, then see my external website at
http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004 and 2005 [up to the end of December] here. This clearly shows that December was significantly quieter than November; in fact it was the quietest month in the last two years, as far as e-mail-bourne malware was concerned!
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 112,438 [as at the end of December 2004] to 168,807 [as at the end of December 2005]. That’s a growth of 56,369 during 2005! In 2004 we saw 28,327 new malware strains, so we have seen an almost 200 percent increase in new malware strains during 2005.
What’s New?
A number of interesting things occurred during December these will be covered below:
More on Sober
I covered Sober in my November report; however there have been several developments in the case. So, to refresh your memory, here’s a quick recap:
Sober.Z used a trick which worked well for an earlier version of the family; it sent forged e-mail messages which claimed to have come from the FBI which claimed that the recipient had violated copyright by downloading music from file-sharing networks. The e-mail message instructs the recipient to open the attachment, which, the e-mail claims, contains data relating to the alleged offence.
Development 1:
In a very ‘Twilight Zone’ like twist the Sober-Z worm led to the arrest of a child porn offender this month. The 20-year-old German man believed the contents of the infected email stating that he was being investigated by the BKA for visiting illegal websites; in a moment of panic he turned himself into the police.
Carole Theriault from Sophos had this to say about the latest twist with Sober:
“Rarely does a virus actually benefit society, but few people would discourage the German police from investigating this guy,” continued Theriault. “However, it is an inadvertent victory for justice - the Sober virus writer has been causing havoc for computer users around the world for several years. The good news is that this persistent worm is easy to combat if home users and businesses have effective up-to-date anti-virus and anti-spam protection in place, and if they follow safe computing practices.”
Development 2:
Sober.Z is programmed to force all the infected machines to download and run a file from a website starting from Midnight on January 6th, 2006. To ensure that this event takes place Sober.Z even synchronizes the computers internal clock using the atomic clocks on the internet.
To make the anti-virus vendors life more difficult the virus writer does not use a single, constant address in the virus body, as it will be quickly blocked. Instead, the Sober.Z author coded an algorithm to create pseudorandom URLs, these will change based on date and use free hosting servers typically operating in Germany or in Austria.
The Sober.Z author can pre-calculate the URL for any date, and when he wants to run something on all the infected machines, he registers the right URL on the required free web server; uploads his program and it gets downloaded by all the infected systems and executed. It is estimated that the current size of infected pool of computers is in the range of hundreds of thousands of machines.
Because the Sober virus author can pre-calculate the URLs, the Anti-Virus companies wanted to be able to do the same thing. So they reverse engineered the algorithm. This enabled them to calculate the Sober.Z download URLs for any future date.
So what do these pseudorandom URLs look like?
They look like this:
- home.arcor.de/dixqshv/
- people.freenet.de/wjpropqmlpohj/
- people.freenet.de/zmnjgmomgbdz/
- people.freenet.de/mclvompycem/
- home.arcor.de/jmqnqgijmng/
- people.freenet.de/urfiqileuq/
- home.arcor.de/nhirmvtg/
- free.pages.at/emcndvwoemn/
- people.freenet.de/fseqepagqfphv/
- home.arcor.de/ocllceclbhs/
- scifi.pages.at/zzzvmkituktgr/
- people.freenet.de/qisezhin/
- home.arcor.de/srvziadzvzr/
- people.freenet.de/smtmeihf/
- home.pages.at/npgwtjgxwthx/
At the time of writing none of these URLs are in use or contain any update files. I will cover what happened with regards the Sober update in the January 2006 report.
However, the list of web links will change every 14 days.
More details can be found here: http://www.lurhq.com/soberdates.html and here: http://www.f-secure.com/weblog/archives/archive-122005.html#00000729
Conclusions:
As you may have noticed SPAM has been very aggressive during December. I will be putting together a ‘Malware Review for 2005′ which will cover the whole year and make some predictions on the probable threats and trends for 2006.
Links:
Virus Top Twenty for December 2005 [Kaspersky]
Top ten viruses and hoaxes for December 2005 [Sophos]
