The Never-Ending Hoax Viruses

Hoax alerts are becoming an increasing drain on corporate resources these days, but, fortunately, as more and more companies implement effective virus-control strategies, they can detect most viruses at the point of entry. However, security professionals increasingly still find themselves spending more time on hoaxes, jokes, and erroneous alerts than on "real" virus incidents.

Many hoax alerts consist of variations on the infamous "Good Times" virus. For instance, most users can easily identify the Deeyenda, PenPal Greetings, and Irina hoax alerts by symptoms such as an excess of capital letters and exclamation marks, citings of unlikely authorities such as the Federal Communications Commission (FCC), and urgings to forward the alert to as many people as possible.

While it is easy enough to circulate details of known hoaxes, it gets harder to tell non-expert computer users how to recognize a new hoax, especially as these hoaxes become more numerous and ingenious.

However, we can currently offer two suggestions:

1. Refer all alerts to a security professional with the contacts and experience to verify them, or the will to acquire the experience.

2. Make it a matter of policy that users don't forward alerts without having them verified.

In addition, we advise "newbie" hoax-watchers to keep an eye on the following web sites:

• http://ciac.llnl.gov/ciac/CIACHoaxes.html

• http://www.kumite.com/myths/

• http://www.datafellows.com/

• http://www.drsolomon.com/

This information first appeared in the February issue of the System Administration, Networking & Security (SANS) Network Security Digest. If you would like additional information on this organization, check out the SANS homepage at the URL http://www.sans.org.

Go to the table of contents.

Go to the Kiosk homepage.