Notification emails cause virus-like chaos
Published: 28 Jan 2004 15:20 GMT
A common antivirus feature that automatically replies to emails infected with a virus to inform the sender that they are infected is obsolete and should be disabled because it creates almost as much trouble as the virus itself, according to security experts.
When an antivirus application detects malware in an email, such as the recent MyDoom worm, it can automatically reply to the sender of that message to inform them that they have been infected. However, virtually all modern email viruses disguise the original sender's address by spoofing the "from" field with a stolen, but valid, email address. This means users receive emails telling them they are infected when they are not, resulting in significant quantities of unnecessary traffic.
This additional traffic is a further burden on administrators because it occurs when companies are trying to clean their systems from the virus attack. Jack Clark, technology consultant at antivirus firm McAfee estimates that "bounce-back" emails play a significant part in slowing down corporate networks and the feature should be disabled immediately.
"There is no real point in trying to tell somebody that they are infected when 99 percent of the viruses that are being produced today will spoof the address. On Tuesday and today, people have noticed that the Internet is a percentage slower. The bounce-back emails could account for up to 25 percent of this slow-down," Clark told ZDNet UK.
Jay Heiser, chief analyst at IT risk management company TruSecure, agreed. He told ZDNet UK that the automatic notification was a good idea a few years ago but now the function was obsolete.
"This technique was useful back in the days before people spoofed email addresses but it is not something that I would encourage right now. The lines are being clogged up with emails flying around, not only from the virus, but also from end users that are concerned they have got the virus when they don't," Heiser said.
Email systems still produce these notifications because administrators are either too busy or see it as a low priority issue, according to Clark: "It is the last thing on people's minds. Administrators are too busy dealing with viruses that get into their systems and they don't see these bounce-back emails -- it is not a high priority," he said.
Heiser believes that the auto-notification feature may have worked as an incentive for virus writers to use email spoofing to give their viruses more time to infect users: "[Spoofing] is a preventive mechanism that the virus writers put in partly because users were being notified that they had been infected too early. This buys the virus more time to spread," he said.
Both Heiser and Clark urge administrators to disable the feature immediately.
Did you find this article useful?
69 out of 167 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
4 comments
