Dueling Hackers Sparked Bagle, Netsky Worm Blitz

Security analysts are asking themselves whether the wave of malicious worms that began traversing the Internet Friday and continued their blitz Tuesday was a coordinated attack or mischievous coincidence.

No question it has been a deluge of worms. Seven variations of Bagle and two of Netsky surfaced in the last five days. Was the flood just happenstance? Or was there something more devious behind the surge?

The answer, said security experts, is a bit of both, with some fighting over hacker turf thrown in for good measure.

"There's no evidence of any connection between the authors of these two worms," said Chris Belthoff, a senior security analyst with Sophos. "There's no master plan here."

Vincent Gullotto, vice president of McAfee's AVERT virus research team, agreed, to a point. "It's not some attempt to destroy the world, but I see it as clearly concerted," he said.By that he means that the tidal wave of worms -- yet another Bagle, dubbed Bagle.i was discovered Tuesday -- is the result of a back and forth battle between competing hackers.

"There's some kind of competition going on between two individuals or two groups," he said, referring to the Bagle and Netsky worm writers. "There's a level of pride at stake, and they're looking to one-up each other."

Ken Dunham, the director of malicious code research at iDefense, also believes the Bagle-Netsky outbreak stemmed from both a coordinated effort on the part of one or more hackers, and an ongoing fight over malware market share.

"The Bagle outbreak is no coincidence," he said. "They were all designed by the same person or person, and released on a rolling schedule.

"There are some very simple techniques hackers can use to remain undetected [by anti-virus software], and by putting out multiple variants nearly simultaneously, there's a good chance that while one may be detected, another will not." The majority of the newest round of Bagle variants, for instance -- including Bagle.f, Bagle.g, Bagle.h, and Tuesday's Bagle.i -- all tucked their payloads within password-protected ZIP files, a technique designed to circumvent anti-virus software.This tactic, flooding the Internet with a slew of close copies in the hopes of overwhelming defenses and sneaking some payload-bearing messages through enterprise and consumer firewalls and anti-virus software, is a trend Dunham thinks will only grow in use by attackers.

"Waves of attacks are the wave of the future," he said. "Expect more waves, as these hackers follow in the footsteps of Mimail and other repetitive worms."

He also joined Gullotto in calling the Bagle vs. Netsky question as more likely a battle over hacker bragging rights than a coordinated plan by multiple worm writers. "Netsky.d was a great example of a turf war. It was actively coded to remove recent worms, including Bagle.c, which appeared last Friday."

Netsky.d, which was first detected on Monday, remains the most dangerous and fastest spreading of the nine worms to hit in the last five days. On Monday, for instance, Symantec upgraded its threat level to a "4" in its 1 through 5 scale, tying the threat ranking for such infamous viruses as MyDoom, Sobig.f, and MSBlast. Symantec has never used the highest rating, "5," on a worm or virus.

No matter whether coincidence or coordination, or a hybrid of the two, the result is an epidemic, with a capital "E," said security firm Panda Software, in an e-mailed statement."The current wave of viruses has reached epidemic proportions worldwide," Panda said. 'They are all spreading at an alarming rate and causing and increasing number of incidents around the globe." Panda's data indicates that there are now millions of infected e-mail messages circulating.

Like iDefense's Dunham, Luis Corrons, head of the Glendale, Calif.-based company's PandaLabs research arm, thinks that hackers will note the success they've made in creating such an epidemic, and run with the example.

"Virus creators are aware of the effectiveness of launching waves of malicious code and the increased probability of infection, so we can expect to see more of these tactics in the future," said Corrons.

Sophos' Belthoff wouldn't go so far as to agree that it's an epidemic. "There's nothing especially innovative in these worms, not like MSBlast, which didn't need human intervention to spread." But the number of worm variations, with so many released in such a short period of time, is unusual, he agreed.

Not to rain on anyone's parade, but if March came in like a lion, don't expect it to go out like a lamb, Dunham said.A confluence of dates and events near the end of March the opening of April, he said, mean that additional threats will surely surface.

"There are a couple of things coming up," said Dunham, "Spring break and April 1 We always see an increase in the end of March." April Fools, when people typically send hoax- and joke-style attachments to friends, are a golden opportunity for hackers to slip their code into the e-mail mix.

And as for spring break? "A lot of these [hackers] are in the college age group, and during spring break, they have a lot of time on their hands." That typically translates into more malware.

"They're surfing the cyber waves, man, they're having parties, they're looking at girls, but they're doing it all on the computer."