'FBI, CIA' e-mails spread virus

2005-11-23 09:43

Washington - A scam involving e-mails appearing to come from the FBI or CIA has unleashed a computer virus that spread rapidly worldwide, United States officials and security experts said on Tuesday.

The Federal Bureau of Investigation (FBI) released a statement on its website noting that the agency was not the source of the e-mails. But experts said the virus was propagating because the authors made the message appear authentic.

The FBI statement said recipients of this or similar messages "should know that the FBI does not engage in the practice of sending unsolicited e-mails to the public in this manner".

The messages appear to be sent from an e-mail address such as [e-mail], [e-mail], [e-mail] or a similar address, and direct the recipient to open an attachment to answer question. The opening of the file activates the virus and causes it to spread to others.

The internet security firm Sophos said similar e-mails may appear to come from the Central Intelligence Agency (CIA), but that both contain a strain of the Sober virus that has been spreading worldwide.

People caught off-guard

In a four-hour period on Tuesday, the worm "has accounted for over 61% of all viruses reported to Sophos, making it currently the most prevalent virus spreading across the world".

"This variant of the Sober worm may catch out the unwary as they open their e-mail inbox this morning," said Graham Cluley, senior technology consultant at Sophos.

"Every law-abiding citizen wants to help the police with their enquiries, and some will panic that they might be being falsely accused of visiting illegal websites and want to click on the unsolicited e-mail attachment."

The e-mail says: "We have logged your IP-address on more than 30 illegal websites," and directs the recipient to open an attachment to respond to questions.

"The FBI takes this matter seriously and is investigating," the law enforcement agency said, urging those receiving e-mails of this nature to report it to the Internet Crime Complaint Centre via http://www.ic3.gov.

Virus rapidly spreading

California-based firm PandaLabs said the virus quickly became the most prevalent spreading around the globe. One reason for its success is that "this new variant uses social engineering techniques, tricking users into running files that contain the system code", PandaLabs said.

The virus uses another trick - displaying a dialogue box saying no viruses, Trojans or spyware were found, according to PandaLabs, even though the computer is left unprotected against future attacks.

Experts noted that each infection causes a computer to send out new copies of the e-mail to those in the computer's address book.

"The propagation capacity of Sober.AH, means that every time there is a new infection, the chances of receiving an infected email increase exponentially," said Luis Corrons, director of PandaLabs.

The SANS Institute's Internet Storm Centre, an academic-industry partnership, urged internet users to exercise caution because anti-virus programs may not detect the latest versions of malicious programs.

- AFP