Recent versions of the Bagle worm have bypassed corporate gateway security measures because they are distributed in password-protected Zip files, which are next to impossible for antivirus programs to scan. E-mails infected with the Bagle worm, however, contain the password required for opening the Zip file.
 | ||||
|
| | ||
|
Get Up to Speed on... Enterprise security  Get the latest headlines and company-specific news in our expanded GUTS section. |
| ||
|
|
||||
|
|
||||
On Wednesday, antivirus vendors BitDefender and Kaspersky Labs both launched updates enabling their software to open any encrypted attachments using the password contained in the e-mail text. Once the file is decrypted, it is treated as an executable file and scanned normally.
Eugene Kaspersky, head of antivirus research at Kaspersky Labs, said: "This new technology protects users from a new generation of worms, specifically worms that hide in password-protected Zip files. Five worms using this technique appeared within only four days--a new trend has been set in the computer underground," he said.
Viorel Canja, head of BitDefender Labs, said in a statement: "We have developed an engine tasked with finding the Zip password in the e-mail text. Most (antivirus) products could only offer protection after the archive is extracted; that could be a little too late for inexperienced users," he said.
Network Box, a security appliance vendor that licenses Kaspersky's antivirus software, has updated its gateway product to include complete protection against Bagle--a first, according to the company.
Simon Heron, director of Network Box, said the product combines Kaspersky's software with Network Box's own technology to deal with the latest Bagle mutations at the network perimeter.
According to Heron, this does mean the gateway is fractionally slower, but by no more than 50 milliseconds per e-mail. "The worst case scenario is we will take 50ms extra to parse an e-mail that has a password-encrypted attachment. We don't think this is a problem," he said.
Munir Kotadia of ZDNet UK reported from London.
