Network-aware viruses use the indigenous file system to spread easily within an organisation, but can also leap between organisations using network file-sharing, according to Paul Ducklin, Sophos's Sydney-based Head of Technology, Asia Pacific.
"For example, if you're running a Microsoft Windows network, you can use a command like 'net use' which allows you to connect to a fileshare on another machine," said Ducklin. By entering an IP number into the command you can attempt to connect to any machine on the Internet, and if the filesharing feature is turned on and no ports are blocked you have complete access to the machine. "That's what many of today's viruses do."
"History seems to have repeated itself," said Ducklin. "Melissa was the first widespread e-mail borne virus, and everyone said 'wow!', but now it is normal." He said it had got to the stage where people think the only vector for viruses is e-mail, but warned "virus writers don't think like that".
"Anything that allows files to be exchanged between machines is a potential vector for viruses," he said.
"It is extremely unlikely that you would actually want to publish Windows shares across the Internet," said Ducklin. "I can't think of any good reason why you would want to do it."
"If you want collaboration a VPN [virtual private network] is a better way to do it. It consists only of your joint set of machines. You also apply strong cryptography on the packets that flow across the networks."
Top Ten Viruses reported to Sophos in July
- W32/Sobig-E (Sobig variant) 47.8% New Entry
- W32/Bugbear-B (Bugbear variant) 11.0%
- W32/Klez-H (Klez variant) 5.9% 18 months in chart
- W32/Sobig-A (Sobig worm) 2.7%
- W32/Parite-B (Parite variant) 0.9% New Entry
- W32/Sobig-B (Sobig variant) 0.9%
- W32/Ganda-A (Ganda worm) 0.8% New Entry
- W32/Opaserv-G (Opaserv variant) 0.7%
- W32/Sobig-D (Sobig variant) 0.7% New Entry
- W95/Dupator (Dupator worm) 0.7% New Entry
- Others: 27.9%
