Security companies have started updating their products with more
sophisticated techniques aimed at getting inside the encrypted attachments in
which the Bagle worm has spread.
Recent versions of the Bagle worm have bypassed corporate
gateway security measures because they are distributed in password-protected Zip
files, which are next to impossible for antivirus programs to scan. E-mails
infected with the Bagle worm, however, contain the password required for opening
the Zip file.
On Wednesday, antivirus vendors BitDefender
Labs both launched updates enabling their software to open any encrypted
attachments using the password contained in the e-mail text. Once the file is
decrypted, it is treated as an executable file and scanned normally.
Eugene Kaspersky, head of antivirus research at Kaspersky Labs, said: "This
new technology protects users from a new generation of worms, specifically worms
that hide in password-protected Zip files. Five worms using this technique
appeared within only four days--a new trend has been set in the computer
underground," he said.
Viorel Canja, head of BitDefender Labs, said in a statement: "We have
developed an engine tasked with finding the Zip password in the e-mail text.
Most (antivirus) products could only offer protection after the archive is
extracted; that could be a little too late for inexperienced users," he
Network Box, a security appliance vendor that licenses Kaspersky's antivirus
software, has updated its gateway product to include complete protection against
Bagle--a first, according to the company.
Simon Heron, director of Network Box, said the product combines Kaspersky's
software with Network Box's own technology to deal with the latest Bagle
mutations at the network perimeter.
According to Heron, this does mean the gateway is fractionally slower, but by
no more than 50 milliseconds per e-mail. "The worst case scenario is we will
take 50ms extra to parse an e-mail that has a password-encrypted attachment. We
don't think this is a problem," he said.
Munir Kotadia of ZDNet
UK reported from London.