Upcoming Events

Cloud Connect
Santa Clara
Feb 13-16, 2012

Cloud Connect brings together the entire cloud eco-system to better understand the transformation we're experiencing and promises to be the defining event of the cloud computing industry. Learn about the latest cloud technologies and platforms from thought leaders in Cloud Connect’s comprehensive conference.

Register Now!

More Events »

Subscribe to Newsletter

  • Keep up with all of the latest news and analysis on the fast-moving IT industry with Network Computing newsletters.
Sign Up

 
NetNews
N E W S / A N A L Y S I S  


Klez Fallout Continues

May 27, 2002
 By Jonathan Feldman


With the Klez virus lingering like a bad dream, many IT managers are resolving to head off the next worm -- installing filters, updating definitions and figuring out how to keep up with the latest Microsoft Internet Explorer patches. After all, an IE update that would have thwarted Klez was released a month before the virus hit.

But in addition to battening down the hatches to shut out viruses, maybe, just maybe, IT managers should focus on controlling spam. Unsolicited and misleading e-mail can wreak havoc among users and helpdesks.



Klez, for instance, used spam to create additional chaos. After hijacking a user's PC, Klez would distribute a message to an address-book member indicating that a different member had the virus. Our organization discovered this after an official called our helpdesk for advice because her county e-mail account had sent a virus to a vendor. But her workstation hadn't done it; it checked out as Klez-free. Our e-mail system wasn't guilty; I verified all pertinent logs. Many similar incidents that week led me to examine the headers on the offending e-mail, and it turned out they'd been forged. The e-mail came from a machine outside our organization.

Other users in our organization received e-mail messages, ostensibly from antivirus servers, telling them they had sent viruses. Although these messages didn't carry viruses, just bad information, they made it through the gateway and caused more helpdesk calls.

Obviously, many helpdesks were busy the week Klez hit, but some were less busy than others. Organizations that subscribe to spam blacklists such as MAPS (Mail Abuse Prevention System) rejected SMTP connections from dial-up PCs and open relays, and therefore didn't let Klez mail through. Naturally, pattern-matching of undesirable e-mail characteristics also helped -- not allowing "iframe" tags in HTML attachments through the gateway, for example. Our organization's spam-rejection stats skyrocketed during Klez week, even during normally quiet periods, hitting 1,600 percent above normal one morning at around 1 a.m.

Did your spam block logs also spike? Share your Klez war stories with me.

--Jonathan Feldman, jf@feldman.org


Research and Reports

Hypervisor Derby
August 2011

Network Computing: August 2011

TechWeb Careers