We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

SCO site downed by Mydoom

Worm still spreading

Computers infected with the Mydoom worm launched a massive attack against the website of Unix software maker The SCO Group yesterday, cutting off access to the company's site.

The so-called "distributed denial-of-service" (or DDoS) attack began early Sunday morning as Mydoom-infected computers worldwide followed instructions to send messages to www.sco.com, overloading the company's web servers. It is one of the largest DDoS attacks on record, antivirus experts said.

In a statement, SCO confirmed the attack, saying that requests sent to www.sco.com from Mydoom-infected computers were responsible for making its website "completely unavailable" yesterday. The company is working on "contingency plans" to deal with the DDoS problem.

SCO's website was already slowed last week by traffic from Mydoom machines with incorrect clocks. However, the site became totally unreachable yesterday, when infected machines in Asia began registering the new day, said Craig Schmugar, antivirus researcher at McAfee.

The attack is caused by thousands of infected machines sending "get" requests to SCO's web servers simultaneously. That is akin to what happens when individual users point their web browser to www.sco.com. The large numbers of machines requesting the site simultaneously produces the attack, overwhelming SCO's web infrastructure, Schmugar said.

The attack is one of the largest DDoS attacks linked to a virus infection, but is not affecting traffic on the rest of the internet, he said.

Estimates of the number of machines infected by Mydoom vary widely. F-Secure of Helsinki said that as many as one million machines may have the virus. McAfee puts the number at around 500,000 systems.

However, for a variety of reasons, only a fraction of the machines infected by the virus are taking part in the attack, Schmugar said.

Machines that have been turned off for the weekend cannot attack. And, due to a coding error in the virus, only around one in four machines that are running and infected will launch an attack, he said.

SCO's website was still down at 10.15 Monday morning.

The Mydoom virus is programmed to continue its attack on www.sco.com until 12 February 04.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

LED vs Halogen: Why now could be the right time to invest in LED bulbs

IDG UK Sites

Christmas' best ads: See great festive spots studios have created to promote themselves and clients

IDG UK Sites

Why Apple shouldn't be blamed for exploitation in China and Indonesia