At last, another perfect summer morning in Boston. Humidity down, no more 'chance of thunderstorms', sunshine and seventies at seven a.m. Car windows down, masspike on-ramp behind me, cityscape and light traffic ahead. Ben Gibbard's voice on the car stereo, a quick drive into work, a perfect dunkies coffee, the overwhelming smell of freshly cut grass along the Southwest Corridor Park.

What was supposed to be a relatively easy workweek became a full-on defensive action, as we were assaulted by the now-infamous LovSan Worm. I'm one of the guys that keeps this kind of stuff at bay, manning the firewalls, pouring pitch on infected machines as they try to crash our gates. It's been a good, solid fight... we were prepared, and our reaction time was swift on Monday morning when it all started.

It's been by far the most serious virus attack I've seen in my nearly two years here, and I've seen more than my share. Watching the firewall logs, you wouldn't believe the number of infected external machines knocking on the doors, trying in vain to get in. It's mostly home users with dsl and cable modems, people who ignored warnings to patch their systems, have no firewalls, no virus protection, probably don't even pay attention to the all the news stories of the past few days. We're also seeing hundreds upon hundreds of scan attempts from the Asia Pacific network, which comes as no surprise considering China has the second-highest number of interneters in the world.

The script kiddie who made this sucker may have done us all a favor... there's no brutal payload, just the ability to spread fast, increase internet traffic, along with a declaration of love and a taunting message to 'billy gates'. It could be much, much worse. Aside from jamming the superhighway, the main side effect will hopefully be to wake people the hell up... viruses don't just come in email anymore, you're not safe if you don't surf, you're not clean if you keep your unknown attachments closed. All you have to do is be connected to the internet to be infected, and to infect others. Patch your machine, keep your virus definitions up to date. Go download and run the brand new version of Stinger. It's free, it's quick, and it looks for the LoveSAN. You might be infected right now and you'd never know it.

SAN-lover actually screwed up when they wrote the thing, creating flawed code that accidentally causes machines to reboot, yet with no other ill effects. It was a mistake that worked against them, because it made users who would have been otherwise clueless realize that something was wrong, and most likely prompted them to scan and clean. It didn't take long for the rest of the black hats to join in on the fun, though. New 'fixed' versions of the virus are already on the loose, ones that don't so obviously reveal themselves, ones that try to skirt around the scanning updates that were released earlier in the week.

The big payoff will be this Saturday, when the various mutations of the thing are set to initiate a full-on denial-of-service attack on Microsoft's WindowsUpdate sites. If you don't update your PC by then, who knows when you'll be able to access it, because the attack goes on non-stop for the next month and a half.

So, there's my week for ya. Long-awaited projects sit untouched, the best made work-plans laid to waste. A dozen in-progress blog entries and pics wait to be posted, the inbox is full of unanswered mail. Hopefully today I'll play catch up, but it's too early to tell. When they aren't on the keyboard, the fingers are crossed...

"The glove compartment is inaccurately named, and everybody knows it. So I'm proposing a swift, orderly change, 'cause behind its door is nothing to keep my fingers warm..." - Death Cab For Cutie

posted by brad at 8:22 AM | direct link | rss (1:2) | |