Patches no longer enough to can the worms

Published Mar 5, 2004

Share

Internet and email users across the world are under attack, with at least 12 "worms" having been released into the Internet over the past three days, and software vendors cannot supply patches and updates fast enough.

Justin Stanford, from information anti-virus software NOD32, said that on Thursday alone, five new worms had been released into the "wild". Because of this frenetic pace, it was not enough to rely on patches.

Since last year worms have pestered computer users worldwide and caused millions of rands' damage. The difference between computer viruses and worms is that worms do not need human interaction with a computer to spread.

On Monday, the Netsky.D worm sent out 12 000 emails in three hours. Brett Myrhoff, chief executive of Sophos distributor Netxactics, said this worm was set to become one of the most prevalent of the year.

Information technology lawyer Reinhardt Buys agreed with Stanford, who was quoted on the IT information service MediaWeb site, that it was "becoming increasingly prudent for companies to address their needs for virus protection".

"We have never seen anything like this," Stanford said.

"Just as anti-virus vendors create a patch, another variant of the same worm is released, leaving the patch obsolete. In the space of a few days many variants of the Bagle, Netsky and MyDoom families have been released, some within minutes of each other, which has made the creation and release of timeous and effective update patches difficult at best."

Stanford said the time it took to identify a worm, analyse it and create a patch "is what allows viruses to spread so rapidly". Instead of relying on updates, PC users should use "heuristics to identify and terminate viruses, even before updates have been developed".

Heuristics is the term for an artificial intelligence created by anti-virus and anti-worm software programme designers. It looked for the actions used by viruses and worms and nipped them in the bud, preventing them from infecting the computer or spreading to other computers, said Stanford.

Related Topics: