The SoBig.f virus mercifully expired last week, providing worm-weary administrators and users with a bit of relief, but the respite may be short-lived.
The original SoBig virus appeared in early January, welcoming workers back from the holidays with a raft of infected messages from big@boss.com. In the intervening eight months, five more variants have been set loose, with varying degrees of success.
But none of the previous versions even remotely approached the infection rates that SoBig.F has achieved.
The latest iteration of the virus hit the Internet Aug. 18 and spawned more than a million copies of itself in the first 24 hours. At its peak later that week, one out of every 17 pieces of e-mail inspected by e-mail security provider MessageLabs Inc. was infected with SoBig.F. The infection rate slowed following the peak, but MessageLabs continued to stop as many as 600,000 copies of the virus each day until the expiration. Those numbers dropped significantly on Sept. 10, when MessageLabs reported seeing fewer than 20,000 copies.
Still, many anti-virus experts expect another variant to be released soon. There is debate in the community on this point, as well as the issue of whether all the previous versions of SoBig were created by one person. But if history is any guide, it wont be long before another variant is flooding in-boxes with maddening levels of junk.
Each version of SoBig had an expiration date on which the virus was programmed to stop attempting to spread. In some cases, new variants arrived just before the previous one expired; in other cases, there was a gap of a week or two between releases.
“I would say that because this one got so much press attention and people are waiting, the author probably will hold fire for a bit,” said Mark Sunner, chief technology officer of MessageLabs, based in New York. “I dont think well actually see one right away because lots of people are now working in unison on this and people are looking for a new variant.”
However, Sunner said he believes that the SoBig epidemic will continue for the foreseeable future for one simple reason: It keeps working.
“This will succeed every time. It exploits a weakness in desktop anti-virus, which is reactive by nature,” said Sunner. “Its a sure thing well see another one. The author is obviously pretty savvy technically and will be mindful that people anticipate another one.”