Latest Sober attack appears to do little damage

06.01.2006
Almost a full day after the latest version of the prolific Sober worm was programmed to launch its next round of attacks, there appears to be little sign that the worm is doing any of the damage it was expected to unleash.

"There's nothing going on with Sober" at the moment, said Joe Telafici, director of operations at McAfee Inc.'s Anti Virus Emergency Response Team (AVERT)

All of the Web sites the last version of the Sober worm was programmed to reach out to and download malicious code from have already been disabled, he said. As a result, no malicious files are available for download by either infected systems or anyone else, he said.

Because the worm -- which surfaced on Nov. 22 -- and its variants have been around for a while, many systems are also likely to have been patched or otherwise protected against the threat, according to Mike Murray, director of vulnerability and exposure research at nCircle Network Security Inc. in San Francisco.

'From what we are seeing out there, things appear to be very much under control,' said Rajat Bhargava, president and CEO of StillSecure Inc., a Superior, Colo.-based security vendor. 'People feel like they may have dodged the bullet."

At the same time, it would be a mistake to dismiss the Sober threat entirely, he said.