E-Mail Virus Hits World Cup Ticket Hopefuls
May 6, 2005
Internet security firms issued a high-level alert to computer users this week about the spread of the "Worms_Sober.S" virus, which makes recipients believe they have won tickets to the 2006 football World Cup. The e-mail worm is part of a bigger virus, also known as Sober.P, which has spread to more than 30 countries since Monday, affecting mainly the United States and South America.
"We have reports from over 30 countries so far in the first 13 or 14 hours since the spread of the virus on Monday," Mikko Hyppoenen, head of anti-virus research at Finnish firm F-Secure, told AFP.
Internet security firm Trend Micro placed Sober.S in its 'red alert' category, saying that "using social engineering techniques, it sends out an e-mail supposedly sent by the soccer organization FIFA," offering tickets to the 2006 tournament in Germany. The e-mail includes correct contact information for a FIFA official. US firm McAfee classified the worm as a "medium risk."
Worm suspected of coming from Germany
World Cup organizers have warned fans that the virus will appear as a ticketing confirmation message from the addresses Ticket@fifa.de and Gewinn@fifa.de and that attachments should not be opened.
The worm spreads through e-mail attachments as a ".zip" file. The messages are written in English or German, and the creator of the worm is believed to come from a German-speaking country, Hyppoenen said.
He said there were no estimates for how many computers had been infected so far, and warned users to exercise caution in opening e-mail attachments since the infected e-mails will appear to come from a person they know.
Most anti-virus systems have already been updated to protect users, Hyppoenen said. "All you need to do is update your anti-virus system."
Europe deemed relatively safe from virus
The impact of the virus is expected to be relatively limited since it was released on Monday at 8:00 pm local time in Germany (1800 GMT), when most users in Europe had shut down their computers for the day.
"Most anti-virus systems had time to update" before users switched on their computers on Tuesday morning, Hyppoenen said. But because of the time difference to the Americas, the United States and South America were harder hit. Hyppoenen added that experts had not yet determined the virus-writer's motive.
Worm provides way in for hacker
"The worm will install a back door so the virus writer can gain access to the infected computer. We don't know yet what his motive is. It could be to attack websites or to send spam," he said.
The first phase of World Cup ticket sales was over-subscribed by 10 times and those fans who were successful in the lottery have already been informed. The second phase, selling only Team Specific Tickets (TSTs) on a first come first served basis, began on Monday. Fans buying those tickets receive immediate confirmation at the end of their booking.