May 5, 2004 - Trend Micro Inc. reports that according to its internal monitoring of virus activity, the WORM_SASSER family of variants continues to increase in infections. WORM_SASSER was first detected on May 1, 2004, and variants A through D have been under detection since May 3, 2004, and since then, Trend Micro has regarded this worm family as a "high" risk to computer users.
WORM_SASSER exploits the Windows Local Security Authority Subsystem Service (LSASS) vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system. To propagate, this worm scans random IP addresses for vulnerable systems.
According to Trend Micro, on May 4th (for the period beginning and ending at 02:00 hrs GMT), there was a 43% increase in "Sasser" worm infections (counting variants A,B,C, and D)compared to the same period on May 3rd. Notably, WORM_SASSER.C infections increased by more than 85%, and WORM_SASSER.D infections increased by more than 176% during this same 24 hour period. WORM_SASSER.B and WORM_SASSER.D infections accelerated from the first to second half of that day, WORM_SASSER.D infections increasing over 90% alone during the last 12 hours of that day.
These increases come despite the raised awareness of the "Sasser" worms. WORM_SASSER's ability to infect systems through random IP addresses and then use each victim machine to seek out more potential victim machines means it can spread at an exponential rate. With more infected systems, the worm can accelerate its search for other systems with the LSASS vulnerability.
"The 'Sasser' worms family has probably not reached its peak yet," commented Joe Hartmann, senior virus researcher and analyst for Trend Micro. "In fact, we should expect these worms to remain in-the-wild for many months or possibly years to come."
Coincidentally, the timing of the worms' release may have been a factor in its slow start. The first variant appeared early Saturday, May 1st, and three more were released over the weekend. May 3rd was a national holiday in the UK, which may have explained some of the recent increase as people returned to offices. The nation of Japan has been celebrating the annual "Golden Week" holiday since last week and many Japanese are expected to return to their offices today.
Trend Micro's virus activity monitoring data is collected through Trend Micro's Housecall online scanning services, and represents a sample of infections occurring throughout the world. Housecall can be found at http://housecall.trendmicro.com.
Trend Micro customers are protected through the latest pattern file, number 885. Customers of Outbreak Prevention Services should download OPP 113 to help protect against spread of this threat. For customers of Damage Cleanup Services, Damage Cleanup template # 335 should be downloaded to help with automated restoration of affected systems. Users of Trend Micro Network VirusWall(tm) 1200 can detect this worm through pattern #10126. The associated vulnerabilities were also described in Vulnerability Assessment pattern # 010.
Customers are recommended to apply the necessary vulnerability patches available from Microsoft to address the LSASS vulnerability.
For more information and solutions, please visit www.trendmicro-europe.com
# # #
About Trend Micro
Trend Micro is a leader in network antivirus and Internet content security software and services. The Tokyo-based corporation has its European headquarters in Marlow, England, and business units worldwide. Trend Micro products are sold through corporate, value-added resellers and managed service providers. For additional information and evaluation copies of all Trend Micro products, visit: www.trendmicro-europe.com.
Trend Micro, the t-ball logo and VirusWall are trademarks or registered trademarks of Trend Micro Incorporated. All other company or product names may be trademarks or registered trademarks of their owners. Information is accurate time it was written and is subject to change without notice.
# # #
For more information please contact:
Trend Micro Europe, Middle East, Africa
Anna Wright
Tel: +44 (0) 1628 400534
Email: anna_wright@trendmicro.co.uk
Lammers van Toorenburg Benelux PR
Anja Breunis / Annegees van Linge
Tel: +31 (0)30 6565 070
E-mail: anja@lvtpr.nl / annegees@lvtpr.nl