Kama Sutra, which also goes by a bewildering range of names including Nyxem.e and Blackmal.e, has been spreading for less than two weeks, and probably has infected several hundred thousand PCs, say analysts. Its most distinguishing characteristic: it will overwrite the data in a long list of document formats -- primarily those of Microsoft Office, but also some of Adobe as well as a pair of popular compression formats -- with a text string, rendering the files useless.
The worm also trips a Web site counter each time a copy infects a computer. It's this counter that led the TISF BlackWorm task force, a loose group of volunteers, to a list of affected domains.
According to Randy Vaughn, a professor of information systems at Baylor University, and a member of the task force, the counting site's host ISP provided a log of the counter page that was invaluable.
"We took the IP addresses and time stamps," said Vaughn, "and matched those to our lists of autonomous systems. We already had an automatic notification [system] running, so we sent out 2,000 notifications."
Once the notifications are received by the ISPs or companies, it's up to them to decide how to alert their users.
The task force came out of the MWP (Malicious Websites and Phishing) and DA research groups, a loose confederation of security professionals who work for anti-spam/anti-virus vendors, various nations' CERTs, universities, and ISPs. The group last mobilized publicly in August 2005 when it put out an alert warning of growing scams after Hurricanes Katrina and Rita hit the Gulf Coast of the U.S.
Vaughn characterized the task force and the MWP/DA as a volunteer "civil defense system," but acknowledged less kind descriptions. "We really don't like the term 'security vigilantes,'" he said.
The task force split the list with the SANS Institute's Internet Storm Center to e-mail notifications to ISPs and other networks whose addresses appeared in the log. "We've had an excellent response," Vaughn said. "I've gotten hundreds of e-mails from the networks we notified. "We've been happy working in the background," he said, "mainly doing notification, but this was a good cause."
It's important to reach computer owners before the Feb. 3 trigger data so that they can run disinfection tools, either updated anti-virus software or standalone programs specially designed to sniff out Kama Sutra.
Part of the problem, admitted Vaughn, is that it's difficult to tell how many machines have been infected with the worm. "We can't say for sure, but I'm guessing around 200,000," he said.
The counter, which until mid-day Wednesday had been accepted by most security professionals as accurate, went wild later in the day, and quickly climbed from about 600,000 to nearly 6 million by mid-day Thursday.
"After investigation with the ISP and various people from our task force it appears that someone (probably the worm author) was trying to be funny and DDoS[ed] the counter," wrote Gadi Evron, another member of the task force and the head of the Israeli government's CERT (Computer Emergency Response Team), on a blog Thursday. "Looking only at unique IP addresses and removing the ones from the DDoS, we end up with only about 300K users whose world is going to crumble on February 3rd."
Other security organizations, including U.S.-based Symantec, agreed. "The DeepSight Threat Analyst Team believes this number is exaggerated," the company said in an alert posted Wednesday morning when the counter was "only" at 700,000.
"That being said [the worm] is currently propagating in the wild," Symantec concluded.